Merge "mmc: card: block: check the user controlled parameters to avoid overflow" (4b7ed6dc) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/mmc/card/block.c

+9 −8

Original line number	Diff line number	Diff line
		@@ -620,6 +620,15 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
		idata = mmc_blk_ioctl_copy_from_user(ic_ptr);
		if (IS_ERR_OR_NULL(idata))
		return PTR_ERR(idata);
		if (idata->ic.postsleep_max_us < idata->ic.postsleep_min_us) {
		pr_err("%s: min value: %u must not be greater than max value: %u\n",
		__func__, idata->ic.postsleep_min_us,
		idata->ic.postsleep_max_us);
		WARN_ON(1);
		err = -EPERM;
		goto cmd_err;
		}

		md = mmc_blk_get(bdev->bd_disk);
		if (!md) {
		err = -EINVAL;
		@@ -636,14 +645,6 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
		cmd.arg = idata->ic.arg;
		cmd.flags = idata->ic.flags;

		if (idata->ic.postsleep_max_us < idata->ic.postsleep_min_us) {
		pr_err("%s: min value: %u must not be greater than max value: %u\n",
		__func__, idata->ic.postsleep_min_us,
		idata->ic.postsleep_max_us);
		WARN_ON(1);
		return -EPERM;
		}

		if (idata->buf_bytes) {
		data.sg = &sg;
		data.sg_len = 1;