lkml.org 
[lkml]   [2018]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 036/328] mei: bus: type promotion bug in mei_nfc_if_version()
    3.16.62-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit b40b3e9358fbafff6a4ba0f4b9658f6617146f9c upstream.

    We accidentally removed the check for negative returns
    without considering the issue of type promotion.
    The "if_version_length" variable is type size_t so if __mei_cl_recv()
    returns a negative then "bytes_recv" is type promoted
    to a high positive value and treated as success.

    Fixes: 582ab27a063a ("mei: bus: fix received data size check in NFC fixup")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.16: adjust filename, context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/misc/mei/nfc.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/misc/mei/nfc.c
    +++ b/drivers/misc/mei/nfc.c
    @@ -292,7 +292,7 @@ static int mei_nfc_if_version(struct mei
    return -ENOMEM;

    bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length);
    - if (bytes_recv < if_version_length) {
    + if (bytes_recv < 0 || bytes_recv < if_version_length) {
    dev_err(&dev->pdev->dev, "Could not read IF version\n");
    ret = -EIO;
    goto err;
    \
     
     \ /
      Last update: 2018-12-09 23:14    [W:6.410 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site