Commit 99c06866 authored by Tomas Winkler's avatar Tomas Winkler Committed by Greg Kroah-Hartman
Browse files

mei: validate the message header only in first fragment. 



RX message header is received in the first fragment of
the message and saved side and it is not modified after that,
we don't need to validate it upon each fragment.

Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f85e8813

drivers/misc/mei/interrupt.c

+19 −7
Original line number Diff line number Diff line
@@ -235,6 +235,17 @@ static inline bool hdr_is_fixed(struct mei_msg_hdr *mei_hdr) 
	return mei_hdr->host_addr == 0 && mei_hdr->me_addr != 0;

}



static inline int hdr_is_valid(u32 msg_hdr)

{

	struct mei_msg_hdr *mei_hdr;



	mei_hdr = (struct mei_msg_hdr *)&msg_hdr;

	if (!msg_hdr || mei_hdr->reserved)

		return -EBADMSG;



	return 0;

}



/**

 * mei_irq_read_handler - bottom half read routine after ISR to

 * handle the read processing.
@@ -256,16 +267,17 @@ int mei_irq_read_handler(struct mei_device *dev, 
		dev->rd_msg_hdr = mei_read_hdr(dev);

		(*slots)--;

		dev_dbg(dev->dev, "slots =%08x.\n", *slots);

	}

	mei_hdr = (struct mei_msg_hdr *) &dev->rd_msg_hdr;

	dev_dbg(dev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));



	if (mei_hdr->reserved || !dev->rd_msg_hdr) {

		ret = hdr_is_valid(dev->rd_msg_hdr);

		if (ret) {

			dev_err(dev->dev, "corrupted message header 0x%08X\n",

				dev->rd_msg_hdr);

		ret = -EBADMSG;

			goto end;

		}

	}



	mei_hdr = (struct mei_msg_hdr *)&dev->rd_msg_hdr;

	dev_dbg(dev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));



	if (mei_slots2data(*slots) < mei_hdr->length) {

		dev_err(dev->dev, "less data available than length=%08x.\n",

CRA Git | Maintained and supported by SUSTech CRA and CCSE