Commit 582ab27a authored by Alexander Usyskin's avatar Alexander Usyskin Committed by Greg Kroah-Hartman

mei: bus: fix received data size check in NFC fixup

NFC version reply size checked against only header size, not against
full message size. That may lead potentially to uninitialized memory access
in version data.

That leads to warnings when version data is accessed:
drivers/misc/mei/bus-fixup.c: warning: '*((void *)&ver+11)' may be used uninitialized in this function [-Wuninitialized]:  => 212:2

Reported in
Build regressions/improvements in v4.9-rc3
https://lkml.org/lkml/2016/10/30/57

Fixes: 59fcd7c6 (mei: nfc: Initial nfc implementation)
Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a909d3e6
...@@ -178,7 +178,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, ...@@ -178,7 +178,7 @@ static int mei_nfc_if_version(struct mei_cl *cl,
ret = 0; ret = 0;
bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length); bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length);
if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) { if (bytes_recv < if_version_length) {
dev_err(bus->dev, "Could not read IF version\n"); dev_err(bus->dev, "Could not read IF version\n");
ret = -EIO; ret = -EIO;
goto err; goto err;
......
...@@ -133,7 +133,7 @@ static int mei_nfc_if_version(struct nfc_mei_phy *phy) ...@@ -133,7 +133,7 @@ static int mei_nfc_if_version(struct nfc_mei_phy *phy)
return -ENOMEM; return -ENOMEM;
bytes_recv = mei_cldev_recv(phy->cldev, (u8 *)reply, if_version_length); bytes_recv = mei_cldev_recv(phy->cldev, (u8 *)reply, if_version_length);
if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) { if (bytes_recv < 0 || bytes_recv < if_version_length) {
pr_err("Could not read IF version\n"); pr_err("Could not read IF version\n");
r = -EIO; r = -EIO;
goto err; goto err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment