patch "mei: validate request value in client notify request ioctl" added to char-misc-linus

This is a note to let you know that I've just added the patch titled

mei: validate request value in client notify request ioctl

to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

From: Alexander Usyskin <[email protected]>
Date: Sun, 17 Jan 2016 12:25:01 +0200
Subject: mei: validate request value in client notify request ioctl

This patch address a possible security issue:

The request field in client notify request ioctl comes from user space as u32 and is downcasted to u8 with out validation.
Check request field to have approved values MEI_HBM_NOTIFICATION_STAR/STOP

---
 drivers/misc/mei/main.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

index 677d0362f334..80f9afcb1382 100644
@@ -458,7 +458,11 @@ static int mei_ioctl_client_notify_request(struct file *file, u32 request)
 {
 	struct mei_cl *cl = file->private_data;
 
-	return mei_cl_notify_request(cl, file, request);
+	if (request != MEI_HBM_NOTIFICATION_START &&
+	    request != MEI_HBM_NOTIFICATION_STOP)
+		return -EINVAL;
+
+	return mei_cl_notify_request(cl, file, (u8)request);
 }
 
 /**

2.7.0