Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1524298

[PATCH 4.4 30/38] mei: bus: fix received data size check in NFC fixup

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexander Usyskin <alexander.usyskin@intel.com>

commit 582ab27a063a506ccb55fc48afcc325342a2deba upstream.

NFC version reply size checked against only header size, not against
full message size. That may lead potentially to uninitialized memory access
in version data.

That leads to warnings when version data is accessed:
drivers/misc/mei/bus-fixup.c: warning: '*((void *)&ver+11)' may be used uninitialized in this function [-Wuninitialized]:  => 212:2

Reported in
Build regressions/improvements in v4.9-rc3
https://lkml.org/lkml/2016/10/30/57

Fixes: 59fcd7c63abf (mei: nfc: Initial nfc implementation)
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/mei/bus-fixup.c |    2 +-
 drivers/nfc/mei_phy.c        |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/misc/mei/bus-fixup.c
+++ b/drivers/misc/mei/bus-fixup.c
@@ -151,7 +151,7 @@ static int mei_nfc_if_version(struct mei
 
 	ret = 0;
 	bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length);
-	if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
+	if (bytes_recv < if_version_length) {
 		dev_err(bus->dev, "Could not read IF version\n");
 		ret = -EIO;
 		goto err;
--- a/drivers/nfc/mei_phy.c
+++ b/drivers/nfc/mei_phy.c
@@ -133,7 +133,7 @@ static int mei_nfc_if_version(struct nfc
 		return -ENOMEM;
 
 	bytes_recv = mei_cldev_recv(phy->cldev, (u8 *)reply, if_version_length);
-	if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
+	if (bytes_recv < 0 || bytes_recv < if_version_length) {
 		pr_err("Could not read IF version\n");
 		r = -EIO;
 		goto err;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/38] 4.4.33-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:40 +0100
  [PATCH 4.4 10/38] pinctrl: cherryview: Prevent possible interrupt storm on resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 06/38] coredump: fix unfreezable coredumping task Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 30/38] mei: bus: fix received data size check in NFC fixup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 05/38] swapfile: fix memory corruption via malformed swapfile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 33/38] i40e: fix call of ndo_dflt_bridge_getlink() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 11/38] staging: iio: ad5933: avoid uninitialized variable in error case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 29/38] iommu/vt-d: Fix dead-locks in disable_dmar_iommu() path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 18/38] toshiba-wmi: Fix loading the driver on non Toshiba laptops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 28/38] iommu/amd: Free domain id when free a domain of struct dma_ops_domain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 31/38] lib/genalloc.c: start search from start of chunk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 32/38] hwrng: core - Dont use a stack buffer in add_early_randomness() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 22/38] scsi: qla2xxx: Fix scsi scan hang triggered if adapter fails during init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 36/38] mmc: mxs: Initialize the spinlock prior to using it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 38/38] netfilter: fix namespace handling in nf_log_proc_dostring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
    Re: [PATCH 4.4 38/38] netfilter: fix namespace handling in  nf_log_proc_dostring Pablo Neira Ayuso <pablo@netfilter.org> - 2016-11-17 12:10 +0100
      Re: [PATCH 4.4 38/38] netfilter: fix namespace handling in  nf_log_proc_dostring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 13:10 +0100
  [PATCH 4.4 35/38] ASoC: sun4i-codec: return error code instead of NULL when create_card fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 20/38] iio: hid-sensors: Increase the precision of scale to fix wrong reading interpretation. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 13/38] Revert "staging: nvec: ps2: change serio type to passthrough" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 17/38] drbd: Fix kernel_sendmsg() usage - potential NULL deref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 37/38] btrfs: qgroup: Prevent qgroup->reserved from going subzero Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 34/38] ACPI / APEI: Fix incorrect return value of ghes_proc() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 12/38] drivers: staging: nvec: remove bogus reset command for PS/2 interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 14/38] staging: nvec: remove managed resource from PS2 driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 26/38] dmaengine: at_xdmac: fix spurious flag status for mem2mem transfers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 15/38] USB: cdc-acm: fix TIOCMIWAIT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 09/38] pinctrl: cherryview: Serialize register access in suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 01/38] ALSA: info: Return error for invalid read/write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 12:00 +0100
  [PATCH 4.4 03/38] ASoC: cs4270: fix DAPM stream name mismatch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 12:00 +0100
  Re: [PATCH 4.4 00/38] 4.4.33-stable review Guenter Roeck <linux@roeck-us.net> - 2016-11-17 23:30 +0100

csiph-web