public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [char-misc-next 1/3] mei: validate the message header only in first fragment.
@ 2017-06-12  9:15 Tomas Winkler
  2017-06-12  9:15 ` [char-misc-next 2/3] mei: drop unreachable code in mei_start Tomas Winkler
  2017-06-12  9:15 ` [char-misc-next 3/3] mei: me: use an index instead of a pointer for private data Tomas Winkler
  0 siblings, 2 replies; 5+ messages in thread
From: Tomas Winkler @ 2017-06-12  9:15 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: Alexander Usyskin, linux-kernel, Tomas Winkler

RX message header is received in the first fragment of
the message and saved side and it is not modified after that,
we don't need to validate it upon each fragment.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
---
 drivers/misc/mei/interrupt.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index c14e35201721..b0b8f18a85e3 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -235,6 +235,17 @@ static inline bool hdr_is_fixed(struct mei_msg_hdr *mei_hdr)
 	return mei_hdr->host_addr == 0 && mei_hdr->me_addr != 0;
 }
 
+static inline int hdr_is_valid(u32 msg_hdr)
+{
+	struct mei_msg_hdr *mei_hdr;
+
+	mei_hdr = (struct mei_msg_hdr *)&msg_hdr;
+	if (!msg_hdr || mei_hdr->reserved)
+		return -EBADMSG;
+
+	return 0;
+}
+
 /**
  * mei_irq_read_handler - bottom half read routine after ISR to
  * handle the read processing.
@@ -256,17 +267,18 @@ int mei_irq_read_handler(struct mei_device *dev,
 		dev->rd_msg_hdr = mei_read_hdr(dev);
 		(*slots)--;
 		dev_dbg(dev->dev, "slots =%08x.\n", *slots);
-	}
-	mei_hdr = (struct mei_msg_hdr *) &dev->rd_msg_hdr;
-	dev_dbg(dev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));
 
-	if (mei_hdr->reserved || !dev->rd_msg_hdr) {
-		dev_err(dev->dev, "corrupted message header 0x%08X\n",
+		ret = hdr_is_valid(dev->rd_msg_hdr);
+		if (ret) {
+			dev_err(dev->dev, "corrupted message header 0x%08X\n",
 				dev->rd_msg_hdr);
-		ret = -EBADMSG;
-		goto end;
+			goto end;
+		}
 	}
 
+	mei_hdr = (struct mei_msg_hdr *)&dev->rd_msg_hdr;
+	dev_dbg(dev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));
+
 	if (mei_slots2data(*slots) < mei_hdr->length) {
 		dev_err(dev->dev, "less data available than length=%08x.\n",
 				*slots);
-- 
2.9.4

^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-06-13 14:33 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-06-12  9:15 [char-misc-next 1/3] mei: validate the message header only in first fragment Tomas Winkler
2017-06-12  9:15 ` [char-misc-next 2/3] mei: drop unreachable code in mei_start Tomas Winkler
2017-06-12  9:15 ` [char-misc-next 3/3] mei: me: use an index instead of a pointer for private data Tomas Winkler
2017-06-13 13:46   ` Greg Kroah-Hartman
2017-06-13 14:33     ` Winkler, Tomas

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox