Commit 4fc34e42 authored Apr 25, 2017 by Siba Prasad

mmc: card: block: check the user controlled parameters to avoid overflow



According to specs, some commands require a delay after
issuing the command. idata->ic struct is received from
user in mmc_blk_ioctl_cmd(). So idata->ic.postsleep_min_us,
idata->ic.postsleep_max_us are user controlled. If the min
and max values are set such as max < min, then operation in
the function do_usleep_range will overflow. For avoiding this,
put a condition for checking max < min. If the condition is
true, then print the error message with respective values and
return error.

Change-Id: I76828b58aa46fc4e195da4ae0babb02a7abf6bbe
Signed-off-by: Siba Prasad <sibap@codeaurora.org>

parent 79459f1b

drivers/mmc/card/block.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -636,6 +636,14 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
		cmd.arg = idata->ic.arg;
		cmd.flags = idata->ic.flags;

		if (idata->ic.postsleep_max_us < idata->ic.postsleep_min_us) {
		pr_err("%s: min value: %u must not be greater than max value: %u\n",
		__func__, idata->ic.postsleep_min_us,
		idata->ic.postsleep_max_us);
		WARN_ON(1);
		return -EPERM;
		}

		if (idata->buf_bytes) {
		data.sg = &sg;
		data.sg_len = 1;