Received: by 2002:a05:6a10:a0d1:0:0:0:0 with SMTP id j17csp4414488pxa; Mon, 10 Aug 2020 08:32:40 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxNXTFaotPIzsvWgIxuu9DrvZJrXnS7jAi5ZZ7ZZQ0zChMDH8Y4fP6VkhXOrsA+rD4BAlb8 X-Received: by 2002:a17:906:c310:: with SMTP id s16mr22328377ejz.466.1597073560578; Mon, 10 Aug 2020 08:32:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597073560; cv=none; d=google.com; s=arc-20160816; b=dnoaleE8/oL25hKsZ9mr4YCFr/t+kDv1YmmgSulP0gE265Lzsc2mG18rGRWZh/+Wlv qGJLe4C5K6Wjvpf/pCpAUm669pDJntapdDfDGls1+i1u0UnLGlcUZsuc3DkQpKX7U+8E UZukwSLY+ylNICCBk6F8YfZz4/3Y1aTXoMLuBEgsYk7M/4fcMddhp7DzGOZxaOxyu2G7 w41n3wTI6JnsfpVO0rNccVnRpnlLJOcK/o1lbWlhWKCeHrliUufFPBMUEDDIW43DUbfu rbLd2jrVRkOh8wToWMm8KtEPvcsOn2DS+0Zu/ylGgV3XsvyozFPzBMaa5xQQRR/bKEqf i7jA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=jw2EeWCK7+PoPryHnQ6WxvippeOBk6RmAwLxPxl4vR4=; b=trr35GXgABigjvXVI659D5+9/YIk51n3G1d1fgyxmDzy3r5LY2L4ZnzsUrTeEG89Yg qe4TZdfmNi/FGnWLMnbM1mF88hTZ4i6BUg5O+qlZXQgFSW1TU7tuV1lOBxtWc13R9cfQ rZNATRf5usBNaeGuwv9mOXTWauK5v7/iZ3pERYGCG0v9ngHExysDo8lkqvQ6kN3yo9RV +uwC24RTA6A6v8Y7a3NJLorExHQIK8Vyj0OX99dORqodAYaUWul9OGHiwkYyuabXwfHJ UDfOdovxAnuBecKDWawmO+R+6mpRqaKMc/lwd9zUnQxbDjhP7G3cDuPub7ZXbwPQY6YD PGvQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=JeCvXyjW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id u6si11067854edd.428.2020.08.10.08.32.16; Mon, 10 Aug 2020 08:32:40 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=JeCvXyjW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728993AbgHJP3m (ORCPT + 99 others); Mon, 10 Aug 2020 11:29:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:35954 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728959AbgHJP3b (ORCPT ); Mon, 10 Aug 2020 11:29:31 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E12D022D07; Mon, 10 Aug 2020 15:29:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597073370; bh=p4V3sOMcIcLg6bOq8lNuDQ3c0vE6GzxHlypxaeyenpk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JeCvXyjWstIb+Ig3fWKBHEVYfLL9qsUrg1q91AUOpTElFVN6DIebanmjtsUdaXYqh a9UsGUuxPKD/XM4ulbrZGOiBE7Oxpco5uUIr8wj4zG+hHwE3MgSYtlVvOi7OEQ4b2t pISwb/VIALlizBgPHqbHX6GoSXNCryDEulZ54UTE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miquel Raynal , Richard Weinberger , Vignesh Raghavendra , stable Subject: [PATCH 4.19 14/48] mtd: properly check all write ioctls for permissions Date: Mon, 10 Aug 2020 17:21:36 +0200 Message-Id: <20200810151804.911709325@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200810151804.199494191@linuxfoundation.org> References: <20200810151804.199494191@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman commit f7e6b19bc76471ba03725fe58e0c218a3d6266c3 upstream. When doing a "write" ioctl call, properly check that we have permissions to do so before copying anything from userspace or anything else so we can "fail fast". This includes also covering the MEMWRITE ioctl which previously missed checking for this. Cc: Miquel Raynal Cc: Richard Weinberger Cc: Vignesh Raghavendra Cc: stable Signed-off-by: Greg Kroah-Hartman [rw: Fixed locking issue] Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman --- drivers/mtd/mtdchar.c | 56 +++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 47 insertions(+), 9 deletions(-) --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -368,9 +368,6 @@ static int mtdchar_writeoob(struct file uint32_t retlen; int ret = 0; - if (!(file->f_mode & FMODE_WRITE)) - return -EPERM; - if (length > 4096) return -EINVAL; @@ -655,6 +652,48 @@ static int mtdchar_ioctl(struct file *fi pr_debug("MTD_ioctl\n"); + /* + * Check the file mode to require "dangerous" commands to have write + * permissions. + */ + switch (cmd) { + /* "safe" commands */ + case MEMGETREGIONCOUNT: + case MEMGETREGIONINFO: + case MEMGETINFO: + case MEMREADOOB: + case MEMREADOOB64: + case MEMLOCK: + case MEMUNLOCK: + case MEMISLOCKED: + case MEMGETOOBSEL: + case MEMGETBADBLOCK: + case MEMSETBADBLOCK: + case OTPSELECT: + case OTPGETREGIONCOUNT: + case OTPGETREGIONINFO: + case OTPLOCK: + case ECCGETLAYOUT: + case ECCGETSTATS: + case MTDFILEMODE: + case BLKPG: + case BLKRRPART: + break; + + /* "dangerous" commands */ + case MEMERASE: + case MEMERASE64: + case MEMWRITEOOB: + case MEMWRITEOOB64: + case MEMWRITE: + if (!(file->f_mode & FMODE_WRITE)) + return -EPERM; + break; + + default: + return -ENOTTY; + } + switch (cmd) { case MEMGETREGIONCOUNT: if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int))) @@ -702,9 +741,6 @@ static int mtdchar_ioctl(struct file *fi { struct erase_info *erase; - if(!(file->f_mode & FMODE_WRITE)) - return -EPERM; - erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL); if (!erase) ret = -ENOMEM; @@ -997,9 +1033,6 @@ static int mtdchar_ioctl(struct file *fi ret = 0; break; } - - default: - ret = -ENOTTY; } return ret; @@ -1043,6 +1076,11 @@ static long mtdchar_compat_ioctl(struct struct mtd_oob_buf32 buf; struct mtd_oob_buf32 __user *buf_user = argp; + if (!(file->f_mode & FMODE_WRITE)) { + ret = -EPERM; + break; + } + if (copy_from_user(&buf, argp, sizeof(buf))) ret = -EFAULT; else