60 lines
1.9 KiB
Diff
60 lines
1.9 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Tomas Winkler <tomas.winkler@intel.com>
|
|
Date: Tue, 11 Feb 2020 18:05:22 +0200
|
|
Subject: [PATCH] mei: limit number of bytes in mei header.
|
|
|
|
The MEI message header provides only 9 bits for storing
|
|
the message size, limiting to 511.
|
|
In theory the host buffer (hbuf) can contain up to 1020 bytes
|
|
(limited by byte = 255 * 4)
|
|
With the current hardware and hbuf size 512, this is not a real issue,
|
|
but as hardening approach we enforce the limit.
|
|
|
|
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
|
|
Link: https://lore.kernel.org/r/20200211160522.7562-1-tomas.winkler@intel.com
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
---
|
|
drivers/misc/mei/client.c | 4 ++--
|
|
drivers/misc/mei/hw.h | 3 +++
|
|
2 files changed, 5 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
|
|
index 42a64f26a0b9..affbc37672ec 100644
|
|
--- a/drivers/misc/mei/client.c
|
|
+++ b/drivers/misc/mei/client.c
|
|
@@ -1839,7 +1839,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
|
|
goto err;
|
|
}
|
|
|
|
- hbuf_len = mei_slots2data(hbuf_slots);
|
|
+ hbuf_len = mei_slots2data(hbuf_slots) & MEI_MSG_MAX_LEN_MASK;
|
|
dr_slots = mei_dma_ring_empty_slots(dev);
|
|
dr_len = mei_slots2data(dr_slots);
|
|
|
|
@@ -1998,7 +1998,7 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
|
|
goto out;
|
|
}
|
|
|
|
- hbuf_len = mei_slots2data(hbuf_slots);
|
|
+ hbuf_len = mei_slots2data(hbuf_slots) & MEI_MSG_MAX_LEN_MASK;
|
|
dr_slots = mei_dma_ring_empty_slots(dev);
|
|
dr_len = mei_slots2data(dr_slots);
|
|
|
|
diff --git a/drivers/misc/mei/hw.h b/drivers/misc/mei/hw.h
|
|
index d4f721a356cc..6f2780b6a5a2 100644
|
|
--- a/drivers/misc/mei/hw.h
|
|
+++ b/drivers/misc/mei/hw.h
|
|
@@ -310,6 +310,9 @@ struct mei_msg_hdr {
|
|
u32 extension[0];
|
|
} __packed;
|
|
|
|
+/* The length is up to 9 bits */
|
|
+#define MEI_MSG_MAX_LEN_MASK GENMASK(9, 0)
|
|
+
|
|
struct mei_bus_message {
|
|
u8 hbm_cmd;
|
|
u8 data[0];
|
|
--
|
|
https://clearlinux.org
|
|
|