Merge "mmc: core : fix arbitrary read/write to user space" (15ecdc2b) · Commits · e / devices / android_kernel_sony_msm8994

drivers/mmc/core/debugfs.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -15,6 +15,7 @@
		#include <linux/slab.h>
		#include <linux/stat.h>
		#include <linux/fault-inject.h>
		#include <linux/uaccess.h>

		#include <linux/mmc/card.h>
		#include <linux/mmc/host.h>
		@@ -408,6 +409,9 @@ static ssize_t mmc_wr_pack_stats_read(struct file filp, char __user ubuf,
		if (!card)
		return cnt;

		if (!access_ok(VERIFY_WRITE, ubuf, cnt))
		return cnt;

		if (!card->wr_pack_stats.print_in_read)
		return 0;

		@@ -548,6 +552,9 @@ static ssize_t mmc_wr_pack_stats_write(struct file *filp,
		if (!card)
		return cnt;

		if (!access_ok(VERIFY_READ, ubuf, cnt))
		return cnt;

		sscanf(ubuf, "%d", &value);
		if (value) {
		mmc_blk_init_packed_statistics(card);
		@@ -587,6 +594,9 @@ static ssize_t mmc_bkops_stats_read(struct file filp, char __user ubuf,
		if (!card)
		return cnt;

		if (!access_ok(VERIFY_WRITE, ubuf, cnt))
		return cnt;

		bkops_stats = &card->bkops_info.bkops_stats;

		if (!bkops_stats->print_stats)