mei: validate request value in client notify request ioctl
authorAlexander Usyskin <alexander.usyskin@intel.com>
Sun, 17 Jan 2016 10:25:01 +0000 (12:25 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 3 Mar 2016 23:07:13 +0000 (15:07 -0800)
commita007fc3d6569b620ec5bca1b4636d952ebdd2627
tree4c610c2dda99c6ad370e40f66fcc2b2d230ef89f
parent6472e6b6afc6e3fb7ec4d2890b4eed0d25f71ae9
mei: validate request value in client notify request ioctl

commit 7326fffb712f09a315bc73cc1ee63843f59b8bd4 upstream.

This patch address a possible security issue:

The request field in client notify request ioctl comes from user space
as u32 and is downcasted to u8 with out validation.
Check request field to have approved values
MEI_HBM_NOTIFICATION_STAR/STOP

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/mei/main.c