From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932249AbcBGVld (ORCPT ); Sun, 7 Feb 2016 16:41:33 -0500 Received: from mga09.intel.com ([134.134.136.24]:15909 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755095AbcBGVhJ (ORCPT ); Sun, 7 Feb 2016 16:37:09 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.22,412,1449561600"; d="scan'208";a="898264996" From: Tomas Winkler To: Greg Kroah-Hartman Cc: Alexander Usyskin , linux-kernel@vger.kernel.org, , Tomas Winkler Subject: [char-misc-next 16/27] mei: bus: check if the device is enabled before data transfer Date: Sun, 7 Feb 2016 23:35:32 +0200 Message-Id: <1454880943-12653-17-git-send-email-tomas.winkler@intel.com> X-Mailer: git-send-email 2.4.3 In-Reply-To: <1454880943-12653-1-git-send-email-tomas.winkler@intel.com> References: <1454880943-12653-1-git-send-email-tomas.winkler@intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alexander Usyskin The bus data transfer interface was missing the check if the device is in enabled state, this may lead to stack corruption during link reset. Cc: #4.0 Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler --- drivers/misc/mei/bus.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c index 990f4f65c35e..83b084558ee5 100644 --- a/drivers/misc/mei/bus.c +++ b/drivers/misc/mei/bus.c @@ -53,6 +53,11 @@ ssize_t __mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length, bus = cl->dev; mutex_lock(&bus->device_lock); + if (bus->dev_state != MEI_DEV_ENABLED) { + rets = -ENODEV; + goto out; + } + if (!mei_cl_is_connected(cl)) { rets = -ENODEV; goto out; @@ -109,6 +114,10 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length) bus = cl->dev; mutex_lock(&bus->device_lock); + if (bus->dev_state != MEI_DEV_ENABLED) { + rets = -ENODEV; + goto out; + } cb = mei_cl_read_cb(cl, NULL); if (cb) -- 2.4.3