Commit 7326fffb authored by Alexander Usyskin's avatar Alexander Usyskin Committed by Greg Kroah-Hartman

mei: validate request value in client notify request ioctl

This patch address a possible security issue:

The request field in client notify request ioctl comes from user space
as u32 and is downcasted to u8 with out validation.
Check request field to have approved values
MEI_HBM_NOTIFICATION_STAR/STOP

Cc: <stable@vger.kernel.org> #4.3+
Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 92e963f5
...@@ -458,7 +458,11 @@ static int mei_ioctl_client_notify_request(struct file *file, u32 request) ...@@ -458,7 +458,11 @@ static int mei_ioctl_client_notify_request(struct file *file, u32 request)
{ {
struct mei_cl *cl = file->private_data; struct mei_cl *cl = file->private_data;
return mei_cl_notify_request(cl, file, request); if (request != MEI_HBM_NOTIFICATION_START &&
request != MEI_HBM_NOTIFICATION_STOP)
return -EINVAL;
return mei_cl_notify_request(cl, file, (u8)request);
} }
/** /**
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment