mmc: core : fix arbitrary read/write to user space
In the MMC card debug_fs the read and write handlers use the strlcat
and sscanf, without checking the pointer given.
Since the pointer is not checked it is possible to write
everywhere (ring 0 or 3).
In order to fix it, an access_ok function is being used to verify
the buffer's pointer supplied by user is valid.
CRs-fixed: 545716
Change-Id: I13ca736337fefe29ff9b0df6a318e7d92240f8b2
Signed-off-by:
Raviv Shvili <rshvili@codeaurora.org>
Loading
Please register or sign in to comment