Skip to contentSkip to conversation

mtd: properly check all write ioctls for permissions

PATCH Applied Greg Kroah-Hartman 2 participants 3 messages Jul 16, 2020 – Jul 23, 2020 Memory technology devices (MTD)

lore
Share & tools
lore

Greg Kroah-Hartman

author
#0 lore raw

PATCH 1/1 mtd: properly check all write ioctls for permissions

When doing a "write" ioctl call, properly check that we have permissions to do so before copying anything from userspace or anything else so we can "fail fast". This includes also covering the MEMWRITE ioctl which previously missed checking for this.

Cc Miquel Raynal <[email protected]>
Cc Richard Weinberger <[email protected]>
Cc Vignesh Raghavendra <[email protected]>
Cc stable <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/mtd/mtdchar.c | 54 +++++++++++++++++++++++++++++++++++--------
 1 file changed, 45 insertions(+), 9 deletions(-)
drivers/mtd/mtdchar.c +45 -9
index c5935b2f9cd1..52c120f9fb0d 100644
@@ -355,9 +355,6 @@ static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd,
 	uint32_t retlen;
 	int ret = 0;
 
-	if (!(file->f_mode & FMODE_WRITE))
-		return -EPERM;
-
 	if (length > 4096)
 		return -EINVAL;
 

@@ -643,6 +640,48 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
 
 	pr_debug("MTD_ioctl\n");
 
+	/*
+	 * Check the file mode to require "dangerous" commands to have write
+	 * permissions.
+	 */
+	switch (cmd) {
+	/* "safe" commands */
+	case MEMGETREGIONCOUNT:
+	case MEMGETREGIONINFO:
+	case MEMGETINFO:
+	case MEMREADOOB:
+	case MEMREADOOB64:
+	case MEMLOCK:
+	case MEMUNLOCK:
+	case MEMISLOCKED:
+	case MEMGETOOBSEL:
+	case MEMGETBADBLOCK:
+	case MEMSETBADBLOCK:
+	case OTPSELECT:
+	case OTPGETREGIONCOUNT:
+	case OTPGETREGIONINFO:
+	case OTPLOCK:
+	case ECCGETLAYOUT:
+	case ECCGETSTATS:
+	case MTDFILEMODE:
+	case BLKPG:
+	case BLKRRPART:
+		break;
+
+	/* "dangerous" commands */
+	case MEMERASE:
+	case MEMERASE64:
+	case MEMWRITEOOB:
+	case MEMWRITEOOB64:
+	case MEMWRITE:
+		if (!(file->f_mode & FMODE_WRITE))
+			return -EPERM;
+		break;
+
+	default:
+		return -ENOTTY;
+	}
+
 	switch (cmd) {
 	case MEMGETREGIONCOUNT:
 		if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int)))

@@ -690,9 +729,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
 	{
 		struct erase_info *erase;
 
-		if(!(file->f_mode & FMODE_WRITE))
-			return -EPERM;
-
 		erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL);
 		if (!erase)
 			ret = -ENOMEM;

@@ -985,9 +1021,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
 		ret = 0;
 		break;
 	}
-
-	default:
-		ret = -ENOTTY;
 	}
 
 	return ret;

@@ -1031,6 +1064,9 @@ static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd,
 		struct mtd_oob_buf32 buf;
 		struct mtd_oob_buf32 __user *buf_user = argp;
 
+		if (!(file->f_mode & FMODE_WRITE))
+			return -EPERM;
+
 		if (copy_from_user(&buf, argp, sizeof(buf)))
 			ret = -EFAULT;
 		else
Signature · 1 line
2.27.0
author
#1 lore raw
Quoted 5 lines · Greg Kroah-Hartman

When doing a "write" ioctl call, properly check that we have permissions to do so before copying anything from userspace or anything else so we can "fail fast". This includes also covering the MEMWRITE ioctl which previously missed checking for this.

Quoted 8 lines
Cc Miquel Raynal <[email protected]>
Cc Richard Weinberger <[email protected]>
Cc Vignesh Raghavendra <[email protected]>
Cc stable <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/mtd/mtdchar.c | 54 +++++++++++++++++++++++++++++++++++--------
 1 file changed, 45 insertions(+), 9 deletions(-)

Any objection to this patch getting into 5.8-final?

I can take this through one of my trees if you all give me an ack :)

thanks,

greg k-h

Applied
#2 lore raw
Quoted 16 lines · Greg Kroah-Hartman
Quoted 5 lines · Greg Kroah-Hartman

When doing a "write" ioctl call, properly check that we have permissions to do so before copying anything from userspace or anything else so we can "fail fast". This includes also covering the MEMWRITE ioctl which previously missed checking for this.

Quoted 8 lines
Cc Miquel Raynal <[email protected]>
Cc Richard Weinberger <[email protected]>
Cc Vignesh Raghavendra <[email protected]>
Cc stable <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/mtd/mtdchar.c | 54 +++++++++++++++++++++++++++++++++++--------
 1 file changed, 45 insertions(+), 9 deletions(-)
Quoted 1 line

Any objection to this patch getting into 5.8-final?

Well, I hoped to get some acks/reviews...

Applied to mtd/fixes! :-)

Signature · 2 lines
Thanks,
//richard