From patchwork Tue Nov 20 23:08:30 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Wolfram Sang X-Patchwork-Id: 10691387 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C5DD6417B for ; Tue, 20 Nov 2018 23:08:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B3098289D3 for ; Tue, 20 Nov 2018 23:08:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A79FB2ABCF; Tue, 20 Nov 2018 23:08:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 64F24289D3 for ; Tue, 20 Nov 2018 23:08:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726786AbeKUJkS (ORCPT ); Wed, 21 Nov 2018 04:40:18 -0500 Received: from sauhun.de ([88.99.104.3]:58282 "EHLO pokefinder.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726553AbeKUJkR (ORCPT ); Wed, 21 Nov 2018 04:40:17 -0500 Received: from localhost (p54B3346D.dip0.t-ipconnect.de [84.179.52.109]) by pokefinder.org (Postfix) with ESMTPSA id 832144C0E9E; Wed, 21 Nov 2018 00:08:38 +0100 (CET) From: Wolfram Sang To: linux-mmc@vger.kernel.org Cc: linux-renesas-soc@vger.kernel.org, Wolfram Sang Subject: [RFC PATCH 1/3] mmc: core: validate user input for RPMB block count Date: Wed, 21 Nov 2018 00:08:30 +0100 Message-Id: <20181120230832.1840-2-wsa+renesas@sang-engineering.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20181120230832.1840-1-wsa+renesas@sang-engineering.com> References: <20181120230832.1840-1-wsa+renesas@sang-engineering.com> Sender: linux-mmc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-mmc@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP For RPMB, block count is a non-zero 16 bit wide number. Reject invalid values from userspace instead of just masking the unneeded bits. Tested with a modified 'mmc-utils' package. Signed-off-by: Wolfram Sang Tested-by: Clément Péron --- drivers/mmc/core/block.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c index c35b5b08bb33..9e0f7e4aa8c6 100644 --- a/drivers/mmc/core/block.c +++ b/drivers/mmc/core/block.c @@ -550,6 +550,9 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, } if (idata->rpmb) { + if (data.blocks > 65535 || !data.blocks) + return -EINVAL; + err = mmc_set_blockcount(card, data.blocks, idata->ic.write_flag & (1 << 31)); if (err)