Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b67c5f87 authored by Zev Weiss's avatar Zev Weiss Committed by David Woodhouse
Browse files

[MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl() 



The MEMGETREGIONINFO ioctl() in mtdchar.c was clobbering user memory by
overwriting more than intended, due the size of struct mtd_erase_region_info
changing in commit 0ecbc81a ('Support
for auto locking flash on power up').

Fix avoids this by copying struct members one by one with put_user(), as there
is no longer a convenient struct to use the size of as the length argument to
copy_to_user().

Signed-off-by: default avatarZev Weiss <zevweiss@gmail.com>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent 02c0267a

drivers/mtd/mtdchar.c

+10 −6
Original line number Diff line number Diff line
@@ -410,16 +410,20 @@ static int mtd_ioctl(struct inode *inode, struct file *file, 


	case MEMGETREGIONINFO:

	{

		struct region_info_user ur;

		uint32_t ur_idx;

		struct mtd_erase_region_info *kr;

		struct region_info_user *ur = (struct region_info_user *) argp;



		if (copy_from_user(&ur, argp, sizeof(struct region_info_user)))

		if (get_user(ur_idx, &(ur->regionindex)))

			return -EFAULT;



		if (ur.regionindex >= mtd->numeraseregions)

			return -EINVAL;

		if (copy_to_user(argp, &(mtd->eraseregions[ur.regionindex]),

				sizeof(struct mtd_erase_region_info)))

		kr = &(mtd->eraseregions[ur_idx]);



		if (put_user(kr->offset, &(ur->offset))

		    || put_user(kr->erasesize, &(ur->erasesize))

		    || put_user(kr->numblocks, &(ur->numblocks)))

			return -EFAULT;



		break;

	}