mei: validate request value in client notify request ioctl

ausyskin · gregkh · commit 7326fffb712f · 2016-02-06T22:12:56.000-08:00
This patch address a possible security issue:

The request field in client notify request ioctl comes from user space
as u32 and is downcasted to u8 with out validation.
Check request field to have approved values
MEI_HBM_NOTIFICATION_STAR/STOP

Cc: &lt;stable@vger.kernel.org&gt; #4.3+
Signed-off-by: Alexander Usyskin &lt;alexander.usyskin@intel.com&gt;
Signed-off-by: Tomas Winkler &lt;tomas.winkler@intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
@@ -458,7 +458,11 @@ static int mei_ioctl_client_notify_request(struct file *file, u32 request)
 {
 	struct mei_cl *cl = file->private_data;
 
-	return mei_cl_notify_request(cl, file, request);
+	if (request != MEI_HBM_NOTIFICATION_START &&
+	    request != MEI_HBM_NOTIFICATION_STOP)
+		return -EINVAL;
+
+	return mei_cl_notify_request(cl, file, (u8)request);
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -458,7 +458,11 @@ static int mei_ioctl_client_notify_request(struct file *file, u32 request)`
`458`	`458`	`{`
`459`	`459`	`struct mei_cl *cl = file->private_data;`
`460`	`460`
`461`		`- return mei_cl_notify_request(cl, file, request);`
	`461`	`+ if (request != MEI_HBM_NOTIFICATION_START &&`
	`462`	`+ request != MEI_HBM_NOTIFICATION_STOP)`
	`463`	`+ return -EINVAL;`
	`464`	`+`
	`465`	`+ return mei_cl_notify_request(cl, file, (u8)request);`
`462`	`466`	`}`
`463`	`467`
`464`	`468`	`/**`