Merge "mmc: card: fix arbitrary write via read handler in mmc_block_test" (05ea1f9e) · Commits · e / devices / android_kernel_sony_msm8994

drivers/mmc/card/mmc_block_test.c

+24 −0

Original line number	Diff line number	Diff line
		@@ -2217,6 +2217,9 @@ static ssize_t send_write_packing_test_read(struct file *file,
		size_t count,
		loff_t *offset)
		{
		if (!access_ok(VERIFY_WRITE, buffer, count))
		return count;

		memset((void *)buffer, 0, count);

		snprintf(buffer, count,
		@@ -2315,6 +2318,9 @@ static ssize_t err_check_test_read(struct file *file,
		size_t count,
		loff_t *offset)
		{
		if (!access_ok(VERIFY_WRITE, buffer, count))
		return count;

		memset((void *)buffer, 0, count);

		snprintf(buffer, count,
		@@ -2423,6 +2429,9 @@ static ssize_t send_invalid_packed_test_read(struct file *file,
		size_t count,
		loff_t *offset)
		{
		if (!access_ok(VERIFY_WRITE, buffer, count))
		return count;

		memset((void *)buffer, 0, count);

		snprintf(buffer, count,
		@@ -2537,6 +2546,9 @@ static ssize_t write_packing_control_test_read(struct file *file,
		size_t count,
		loff_t *offset)
		{
		if (!access_ok(VERIFY_WRITE, buffer, count))
		return count;

		memset((void *)buffer, 0, count);

		snprintf(buffer, count,
		@@ -2619,6 +2631,9 @@ static ssize_t bkops_test_read(struct file *file,
		size_t count,
		loff_t *offset)
		{
		if (!access_ok(VERIFY_WRITE, buffer, count))
		return count;

		memset((void *)buffer, 0, count);

		snprintf(buffer, count,
		@@ -2707,6 +2722,9 @@ static ssize_t long_sequential_read_test_read(struct file *file,
		size_t count,
		loff_t *offset)
		{
		if (!access_ok(VERIFY_WRITE, buffer, count))
		return count;

		memset((void *)buffer, 0, count);

		snprintf(buffer, count,
		@@ -2867,6 +2885,9 @@ static ssize_t long_sequential_write_test_read(struct file *file,
		size_t count,
		loff_t *offset)
		{
		if (!access_ok(VERIFY_WRITE, buffer, count))
		return count;

		memset((void *)buffer, 0, count);

		snprintf(buffer, count,
		@@ -2940,6 +2961,9 @@ static ssize_t new_req_notification_test_read(struct file *file,
		size_t count,
		loff_t *offset)
		{
		if (!access_ok(VERIFY_WRITE, buffer, count))
		return count;

		memset((void *)buffer, 0, count);

		snprintf(buffer, count,