redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

mei: fix potential read outside of array bounds

Browse source 
Drop not-very-useful check and with this
fix read on index that can be after array end.
Cleanup search function as byproduct.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alexander Usyskin 2014-02-17 15:13:22 +02:00 committed by Greg Kroah-Hartman
parent 64092858ac
commit a27a76d3c0
1 changed files with 10 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
drivers/misc/mei/client.c
View file

@ -29,20 +29,21 @@
* mei_me_cl_by_uuid - locate index of me client * mei_me_cl_by_uuid - locate index of me client
* *
* @dev: mei device * @dev: mei device
*
* Locking: called under "dev->device_lock" lock
*
* returns me client index or -ENOENT if not found * returns me client index or -ENOENT if not found
*/ */
int mei_me_cl_by_uuid(const struct mei_device *dev, const uuid_le *uuid) int mei_me_cl_by_uuid(const struct mei_device *dev, const uuid_le *uuid)
{ {
int i, res = -ENOENT; int i;
for (i = 0; i < dev->me_clients_num; ++i) for (i = 0; i < dev->me_clients_num; ++i)
if (uuid_le_cmp(*uuid, if (uuid_le_cmp(*uuid,
dev->me_clients[i].props.protocol_name) == 0) { dev->me_clients[i].props.protocol_name) == 0)
res = i; return i;
break;
}
return res; return -ENOENT;
} }
@ -60,16 +61,12 @@ int mei_me_cl_by_uuid(const struct mei_device *dev, const uuid_le *uuid)
int mei_me_cl_by_id(struct mei_device *dev, u8 client_id) int mei_me_cl_by_id(struct mei_device *dev, u8 client_id)
{ {
int i; int i;
for (i = 0; i < dev->me_clients_num; i++) for (i = 0; i < dev->me_clients_num; i++)
if (dev->me_clients[i].client_id == client_id) if (dev->me_clients[i].client_id == client_id)
break;
if (WARN_ON(dev->me_clients[i].client_id != client_id))
return -ENOENT;
if (i == dev->me_clients_num)
return -ENOENT;
return i; return i;
return -ENOENT;
} }