mei: validate request value in client notify request ioctl
authorAlexander Usyskin <alexander.usyskin@intel.com>
Sun, 17 Jan 2016 10:25:01 +0000 (12:25 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 7 Feb 2016 06:12:56 +0000 (22:12 -0800)
commit7326fffb712f09a315bc73cc1ee63843f59b8bd4
tree5f542b8e6172be47df34e28ab2b18c61064b4971
parent92e963f50fc74041b5e9e744c330dca48e04f08d
mei: validate request value in client notify request ioctl

This patch address a possible security issue:

The request field in client notify request ioctl comes from user space
as u32 and is downcasted to u8 with out validation.
Check request field to have approved values
MEI_HBM_NOTIFICATION_STAR/STOP

Cc: <stable@vger.kernel.org> #4.3+
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/mei/main.c