From: Pali Rohár <pali.rohar@gmail.com>
Date: Fri, 17 Jun 2016 22:54:44 +0000 (+0200)
Subject: hwmon: (dell-smm) Fail in ioctl I8K_BIOS_VERSION when bios version is not a number
X-Git-Tag: v4.7-rc5~33^2~2
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=053ea640818812313892ec4f370f5cfac42fd355;p=karo-tx-linux.git

hwmon: (dell-smm) Fail in ioctl I8K_BIOS_VERSION when bios version is not a number

ABI of I8K_BIOS_VERSION ioctl can return only number. But new BIOS versions
contain also other characters, which does not fit into that ABI. So in case
of non digit values return -EINVAL.

Reported-by: Mario Limonciello <Mario_Limonciello@dell.com>
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---

diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index c43318d3416e..480b2fae9541 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -35,6 +35,7 @@
 #include <linux/uaccess.h>
 #include <linux/io.h>
 #include <linux/sched.h>
+#include <linux/ctype.h>
 
 #include <linux/i8k.h>
 
@@ -387,6 +388,10 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
 
 	switch (cmd) {
 	case I8K_BIOS_VERSION:
+		if (!isdigit(bios_version[0]) || !isdigit(bios_version[1]) ||
+		    !isdigit(bios_version[2]))
+			return -EINVAL;
+
 		val = (bios_version[0] << 16) |
 				(bios_version[1] << 8) | bios_version[2];
 		break;