xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mei: fix possible integer overflow issue

Browse Source 
There is a possible integer overflow following by a buffer overflow
when accumulating messages coming from the FW to compose a full payload.
Occurrence of wrap around has to be prevented for next message size
calculation.
For unsigned integer the addition overflow has occurred when the
result is smaller than one of the arguments.
To simplify the fix, the types of buf.size and buf_idx are set to the
same width, namely size_t also to be aligned with the type of length
parameter in file read/write ops.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Tomas Winkler
2016-02-07 23:35:19 +02:00
committed by Greg Kroah-Hartman
parent 439a74b337
commit f862b6b24f
5 changed files with 24 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/misc/mei/main.c
View File

@@ -226,7 +226,7 @@ copy_buffer:
goto free;
}
cl_dbg(dev, cl, "buf.size = %d buf.idx = %ld offset = %lld\n",
cl_dbg(dev, cl, "buf.size = %zd buf.idx = %zd offset = %lld\n",
cb->buf.size, cb->buf_idx, *offset);
if (*offset >= cb->buf_idx) {
rets = 0;
@@ -245,7 +245,8 @@ copy_buffer:
rets = length;
*offset += length;
if ((unsigned long)*offset < cb->buf_idx)
/* not all data was read, keep the cb */
if (*offset < cb->buf_idx)
goto out;
free: