mei: limit number of bytes in mei header. (3aef021b) · Commits · 戴 / test

The MEI message header provides only 9 bits for storing the message size, limiting to 511. In theory the host buffer (hbuf) can contain up to 1020 bytes (limited by byte = 255 * 4) With the current hardware and hbuf size 512, this is not a real issue, but as hardening approach we enforce the limit. Signed-off-by:

Tomas Winkler <tomas.winkler@intel.com> Link: https://lore.kernel.org/r/20200211160522.7562-1-tomas.winkler@intel.com Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/misc/mei/client.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1585,7 +1585,7 @@ int mei_cl_irq_write(struct mei_cl cl, struct mei_cl_cb cb,
		goto err;
		}

		hbuf_len = mei_slots2data(hbuf_slots);
		hbuf_len = mei_slots2data(hbuf_slots) & MEI_MSG_MAX_LEN_MASK;
		dr_slots = mei_dma_ring_empty_slots(dev);
		dr_len = mei_slots2data(dr_slots);

		@@ -1718,7 +1718,7 @@ ssize_t mei_cl_write(struct mei_cl cl, struct mei_cl_cb cb)
		goto out;
		}

		hbuf_len = mei_slots2data(hbuf_slots);
		hbuf_len = mei_slots2data(hbuf_slots) & MEI_MSG_MAX_LEN_MASK;
		dr_slots = mei_dma_ring_empty_slots(dev);
		dr_len = mei_slots2data(dr_slots);

drivers/misc/mei/hw.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -209,6 +209,9 @@ struct mei_msg_hdr {
		u32 extension[0];
		} __packed;

		/* The length is up to 9 bits */
		#define MEI_MSG_MAX_LEN_MASK GENMASK(9, 0)

		#define MEI_MSG_HDR_MAX 2

		struct mei_bus_message {

Admin message