Skip to contentSkip to conversation

Patch "mmc: block: fix ABI regression of mmc_blk_ioctl" has been added to the 4.4-stable tree

PATCH [email protected] 1 participant 1 message Apr 10, 2016

Subsystems (2)
Stable branch MMC, SD and SDIO
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

mmc: block: fix ABI regression of mmc_blk_ioctl

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mmc-block-fix-abi-regression-of-mmc_blk_ioctl.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 83c742c344c08c2bbe338d45c6ec63110e9d5e3d Mon Sep 17 00:00:00 2001

From: Shawn Lin <[email protected]>
Date: Wed, 16 Mar 2016 18:15:47 +0800
Subject: mmc: block: fix ABI regression of mmc_blk_ioctl

From: Shawn Lin <[email protected]>

commit 83c742c344c08c2bbe338d45c6ec63110e9d5e3d upstream.

If mmc_blk_ioctl returns -EINVAL, blkdev_ioctl continues to work without returning err to user-space. But now we check CAP_SYS_RAWIO firstly, so we return -EPERM to blkdev_ioctl, which make blkdev_ioctl return -EPERM to user-space directly. So this will break all the ioctl with BLKROSET. Now we find Android-adb suffer it for the following log:

remount of /system failed;
couldn't make block device writable: Operation not permitted openat(AT_FDCWD, "/dev/block/platform/ff420000.dwmmc/by-name/system", O_RDONLY) = 3 ioctl(3, BLKROSET, 0) = -1 EPERM (Operation not permitted)

Fixes a5f5774c55a2 ("mmc: block: Add new ioctl to send multi commands")
Signed-off-by Shawn Lin <[email protected]>
Signed-off-by Ulf Hansson <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/mmc/card/block.c |   24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)
drivers/mmc/card/block.c +16 -8
@@ -596,6 +596,14 @@ static int mmc_blk_ioctl_cmd(struct bloc
 	struct mmc_card *card;
 	int err = 0, ioc_err = 0;
 
+	/*
+	 * The caller must have CAP_SYS_RAWIO, and must be calling this on the
+	 * whole block device, not on a partition.  This prevents overspray
+	 * between sibling partitions.
+	 */
+	if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains))
+		return -EPERM;
+
 	idata = mmc_blk_ioctl_copy_from_user(ic_ptr);
 	if (IS_ERR(idata))
 		return PTR_ERR(idata);

@@ -638,6 +646,14 @@ static int mmc_blk_ioctl_multi_cmd(struc
 	int i, err = 0, ioc_err = 0;
 	__u64 num_of_cmds;
 
+	/*
+	 * The caller must have CAP_SYS_RAWIO, and must be calling this on the
+	 * whole block device, not on a partition.  This prevents overspray
+	 * between sibling partitions.
+	 */
+	if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains))
+		return -EPERM;
+
 	if (copy_from_user(&num_of_cmds, &user->num_of_cmds,
 			   sizeof(num_of_cmds)))
 		return -EFAULT;

@@ -693,14 +709,6 @@ cmd_err:
 static int mmc_blk_ioctl(struct block_device *bdev, fmode_t mode,
 	unsigned int cmd, unsigned long arg)
 {
-	/*
-	 * The caller must have CAP_SYS_RAWIO, and must be calling this on the
-	 * whole block device, not on a partition.  This prevents overspray
-	 * between sibling partitions.
-	 */
-	if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains))
-		return -EPERM;
-
 	switch (cmd) {
 	case MMC_IOC_CMD:
 		return mmc_blk_ioctl_cmd(bdev,

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/mmc-block-fix-abi-regression-of-mmc_blk_ioctl.patch