From: Tomas Winkler <tomas.winkler@intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Alexander Usyskin <alexander.usyskin@intel.com>,
linux-kernel@vger.kernel.org, <stable@vger.kernel.org>,
Tomas Winkler <tomas.winkler@intel.com>
Subject: [char-misc-next 16/27] mei: bus: check if the device is enabled before data transfer
Date: Sun, 7 Feb 2016 23:35:32 +0200 [thread overview]
Message-ID: <1454880943-12653-17-git-send-email-tomas.winkler@intel.com> (raw)
In-Reply-To: <1454880943-12653-1-git-send-email-tomas.winkler@intel.com>
From: Alexander Usyskin <alexander.usyskin@intel.com>
The bus data transfer interface was missing the check if the device is
in enabled state, this may lead to stack corruption during link reset.
Cc: <stable@vger.kernel.org> #4.0
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
---
drivers/misc/mei/bus.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 990f4f65c35e..83b084558ee5 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -53,6 +53,11 @@ ssize_t __mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
bus = cl->dev;
mutex_lock(&bus->device_lock);
+ if (bus->dev_state != MEI_DEV_ENABLED) {
+ rets = -ENODEV;
+ goto out;
+ }
+
if (!mei_cl_is_connected(cl)) {
rets = -ENODEV;
goto out;
@@ -109,6 +114,10 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
bus = cl->dev;
mutex_lock(&bus->device_lock);
+ if (bus->dev_state != MEI_DEV_ENABLED) {
+ rets = -ENODEV;
+ goto out;
+ }
cb = mei_cl_read_cb(cl, NULL);
if (cb)
--
2.4.3
next prev parent reply other threads:[~2016-02-07 21:41 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-07 21:35 [char-misc-next 00/27] mei: fixes, improvements, and cleanups Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 01/27] mei: debugfs: adjust active clients print buffer Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 02/27] mei: debugfs: allow hbm features list dump in earlier stages Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 03/27] mei: fix possible integer overflow issue Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 04/27] mei: call stop on failed char device register Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 05/27] mei: amthif: don't copy from an empty buffer Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 06/27] mei: amthif: don't drop read packets on timeout Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 07/27] mei: constify struct file pointer Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 08/27] mei: rename variable names 'file_object' to fp Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 09/27] mei: amthif: allow only one request at a time Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 10/27] mei: amthif: replace amthif_rd_complete_list with rd_completed Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 11/27] mei: amthif: drop parameter validation from mei_amthif_write Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 12/27] mei: amthif: use rx_wait queue also for amthif client Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 13/27] mei: amthif: interrupt reader on link reset Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 14/27] mei: bus: fix RX event scheduling Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 15/27] mei: bus: fix notification event delivery Tomas Winkler
2016-02-07 21:35 ` Tomas Winkler [this message]
2016-02-07 21:35 ` [char-misc-next 17/27] mei: drop superfluous closing bracket from write traces Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 18/27] mei: wake blocked write on link reset Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 19/27] mei: clean write queues and wake waiters on disconnect Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 20/27] mei: discard replies from unconnected fixed address clients Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 21/27] mei: fill file pointer in read cb for fixed address client Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 22/27] mei: fixed address clients for the new platforms Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 23/27] mei: hbm: warn about fw-initiated disconnect Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 24/27] mei: drop reserved host client ids Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 25/27] mei: bus: run rescan on me_clients list change Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 26/27] mei: hbm: send immediate reply flag in enum request Tomas Winkler
2016-02-07 21:35 ` [char-misc-next 27/27] mei: split amthif client init from end of clients enumeration Tomas Winkler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1454880943-12653-17-git-send-email-tomas.winkler@intel.com \
--to=tomas.winkler@intel.com \
--cc=alexander.usyskin@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).