diff options
| author | Alexander Usyskin <alexander.usyskin@intel.com> | 2016-10-31 19:02:39 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-10-31 10:25:22 -0600 |
| commit | 582ab27a063a506ccb55fc48afcc325342a2deba (patch) | |
| tree | 022881574d27b4ef75f42ca1da13d1bea27fe1d9 /drivers/misc | |
| parent | a909d3e636995ba7c349e2ca5dbb528154d4ac30 (diff) | |
| download | op-kernel-dev-582ab27a063a506ccb55fc48afcc325342a2deba.zip op-kernel-dev-582ab27a063a506ccb55fc48afcc325342a2deba.tar.gz | |
mei: bus: fix received data size check in NFC fixup
NFC version reply size checked against only header size, not against
full message size. That may lead potentially to uninitialized memory access
in version data.
That leads to warnings when version data is accessed:
drivers/misc/mei/bus-fixup.c: warning: '*((void *)&ver+11)' may be used uninitialized in this function [-Wuninitialized]: => 212:2
Reported in
Build regressions/improvements in v4.9-rc3
https://lkml.org/lkml/2016/10/30/57
Fixes: 59fcd7c63abf (mei: nfc: Initial nfc implementation)
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/mei/bus-fixup.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c index e9e6ea3..75b9d4a 100644 --- a/drivers/misc/mei/bus-fixup.c +++ b/drivers/misc/mei/bus-fixup.c @@ -178,7 +178,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, ret = 0; bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length); - if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) { + if (bytes_recv < if_version_length) { dev_err(bus->dev, "Could not read IF version\n"); ret = -EIO; goto err; |
