Merge "mmc: card: block: check the user controlled parameters to avoid overflow" (24a830c7) · Commits · e / devices / android_kernel_sony_msm8998

drivers/mmc/card/block.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -875,6 +875,14 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card card, struct mmc_blk_data md,
		cmd.arg = idata->ic.arg;
		cmd.flags = idata->ic.flags;

		if (idata->ic.postsleep_max_us < idata->ic.postsleep_min_us) {
		pr_err("%s: min value: %u must not be greater than max value: %u\n",
		__func__, idata->ic.postsleep_min_us,
		idata->ic.postsleep_max_us);
		WARN_ON(1);
		return -EPERM;
		}

		if (idata->buf_bytes) {
		data.sg = &sg;
		data.sg_len = 1;