Commit a99e2925 authored Apr 27, 2017 by Siba Prasad Committed by Gerrit - the friendly Code Review server Apr 28, 2017

mmc: card: block: check the user controlled parameters to avoid overflow



According to specs, some commands require a delay after
issuing the command. idata->ic struct is received from
user in mmc_blk_ioctl_cmd(). So idata->ic.postsleep_min_us,
idata->ic.postsleep_max_us are user controlled. If the min
and max values are set such as max < min, then operation in
the function do_usleep_range will overflow. For avoiding this,
put a condition for checking max < min. If the condition is
true, then print the error message with respective values and
return error.

Change-Id: I3722b8527a7caa6a76dafb9fd23187e77f2478ee
Signed-off-by: Siba Prasad <sibap@codeaurora.org>

parent 1dddc2e8

drivers/mmc/card/block.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -620,6 +620,15 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
		idata = mmc_blk_ioctl_copy_from_user(ic_ptr);
		if (IS_ERR_OR_NULL(idata))
		return PTR_ERR(idata);
		if (idata->ic.postsleep_max_us < idata->ic.postsleep_min_us) {
		pr_err("%s: min value: %u must not be greater than max value: %u\n",
		__func__, idata->ic.postsleep_min_us,
		idata->ic.postsleep_max_us);
		WARN_ON(1);
		err = -EPERM;
		goto cmd_err;
		}

		md = mmc_blk_get(bdev->bd_disk);
		if (!md) {
		err = -EINVAL;