linux-kernel - [PATCH] mmc: core: Return correct emmc response in case of ioctl error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20210805202429.23127-1-nishadkamdar@gmail.com>
Date:   Fri,  6 Aug 2021 01:54:29 +0530
From:   Nishad Kamdar <nishadkamdar@...il.com>
To:     Ulf Hansson <ulf.hansson@...aro.org>, Jens Axboe <axboe@...nel.dk>,
        Adrian Hunter <adrian.hunter@...el.com>,
        Bean Huo <beanhuo@...ron.com>,
        Shawn Lin <shawn.lin@...k-chips.com>,
        Avri Altman <avri.altman@....com>
Cc:     Nishad Kamdar <nishadkamdar@...il.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-mmc@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] mmc: core: Return correct emmc response in case of ioctl error

When a command is sent via ioctl to the kernel, and the command fails,
the actual error response of the emmc is not sent to the user.

I have tried this by sending CMD17 (Single Block Read) from user space
via ioctl with and out of range address as an argument.
The response I receive is 0x00000000.
This is because the actual response is copied later in the function
__mmc_blk_ioctl_cmd() after the data error is detected.
This output is misleading to the user as the actual emmc response is
0x8000900 which clearly shows that is an OUT_OF_RANGE error.

The patch fixes this issue by copying to contents of the response to
before issuing the error.
Thus the user will get the correct response and will see the error as
well.

Signed-off-by: Nishad Kamdar <nishadkamdar@...il.com>
---
 drivers/mmc/core/block.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index a9ad9f5fa9491..efa92aa7e2368 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -522,11 +522,13 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
 	if (cmd.error) {
 		dev_err(mmc_dev(card->host), "%s: cmd error %d\n",
 						__func__, cmd.error);
+		memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
 		return cmd.error;
 	}
 	if (data.error) {
 		dev_err(mmc_dev(card->host), "%s: data error %d\n",
 						__func__, data.error);
+		memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
 		return data.error;
 	}

-- 
2.17.1