mei: fix potential read outside of array bounds
Drop not-very-useful check and with this fix read on index that can be after array end. Cleanup search function as byproduct. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
64092858ac
commit
a27a76d3c0
|
@ -29,20 +29,21 @@
|
||||||
* mei_me_cl_by_uuid - locate index of me client
|
* mei_me_cl_by_uuid - locate index of me client
|
||||||
*
|
*
|
||||||
* @dev: mei device
|
* @dev: mei device
|
||||||
|
*
|
||||||
|
* Locking: called under "dev->device_lock" lock
|
||||||
|
*
|
||||||
* returns me client index or -ENOENT if not found
|
* returns me client index or -ENOENT if not found
|
||||||
*/
|
*/
|
||||||
int mei_me_cl_by_uuid(const struct mei_device *dev, const uuid_le *uuid)
|
int mei_me_cl_by_uuid(const struct mei_device *dev, const uuid_le *uuid)
|
||||||
{
|
{
|
||||||
int i, res = -ENOENT;
|
int i;
|
||||||
|
|
||||||
for (i = 0; i < dev->me_clients_num; ++i)
|
for (i = 0; i < dev->me_clients_num; ++i)
|
||||||
if (uuid_le_cmp(*uuid,
|
if (uuid_le_cmp(*uuid,
|
||||||
dev->me_clients[i].props.protocol_name) == 0) {
|
dev->me_clients[i].props.protocol_name) == 0)
|
||||||
res = i;
|
return i;
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
return res;
|
return -ENOENT;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -60,16 +61,12 @@ int mei_me_cl_by_uuid(const struct mei_device *dev, const uuid_le *uuid)
|
||||||
int mei_me_cl_by_id(struct mei_device *dev, u8 client_id)
|
int mei_me_cl_by_id(struct mei_device *dev, u8 client_id)
|
||||||
{
|
{
|
||||||
int i;
|
int i;
|
||||||
|
|
||||||
for (i = 0; i < dev->me_clients_num; i++)
|
for (i = 0; i < dev->me_clients_num; i++)
|
||||||
if (dev->me_clients[i].client_id == client_id)
|
if (dev->me_clients[i].client_id == client_id)
|
||||||
break;
|
|
||||||
if (WARN_ON(dev->me_clients[i].client_id != client_id))
|
|
||||||
return -ENOENT;
|
|
||||||
|
|
||||||
if (i == dev->me_clients_num)
|
|
||||||
return -ENOENT;
|
|
||||||
|
|
||||||
return i;
|
return i;
|
||||||
|
|
||||||
|
return -ENOENT;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue