On 7/23/20 09:59, Tomas Winkler wrote:
> There is a possibility of bug when variable type has changed but
> corresponding struct passed to the sizeof has not.
>
> Cc: Gustavo A. R. Silva <[email protected]>
> Signed-off-by: Tomas Winkler <[email protected]>
Reviewed-by: Gustavo A. R. Silva <[email protected]>
Thanks
--
Gustavo
> ---
> drivers/misc/mei/bus-fixup.c | 23 +++++++++++------------
> drivers/misc/mei/bus.c | 2 +-
> 2 files changed, 12 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
> index 910f059b3384..07ba16d46690 100644
> --- a/drivers/misc/mei/bus-fixup.c
> +++ b/drivers/misc/mei/bus-fixup.c
> @@ -1,6 +1,6 @@
> // SPDX-License-Identifier: GPL-2.0
> /*
> - * Copyright (c) 2013-2019, Intel Corporation. All rights reserved.
> + * Copyright (c) 2013-2020, Intel Corporation. All rights reserved.
> * Intel Management Engine Interface (Intel MEI) Linux driver
> */
>
> @@ -159,17 +159,17 @@ static int mei_osver(struct mei_cl_device *cldev)
> static int mei_fwver(struct mei_cl_device *cldev)
> {
> char buf[MKHI_FWVER_BUF_LEN];
> - struct mkhi_msg *req;
> + struct mkhi_msg req;
> + struct mkhi_msg *rsp;
> struct mkhi_fw_ver *fwver;
> int bytes_recv, ret, i;
>
> memset(buf, 0, sizeof(buf));
>
> - req = (struct mkhi_msg *)buf;
> - req->hdr.group_id = MKHI_GEN_GROUP_ID;
> - req->hdr.command = MKHI_GEN_GET_FW_VERSION_CMD;
> + req.hdr.group_id = MKHI_GEN_GROUP_ID;
> + req.hdr.command = MKHI_GEN_GET_FW_VERSION_CMD;
>
> - ret = __mei_cl_send(cldev->cl, buf, sizeof(struct mkhi_msg_hdr),
> + ret = __mei_cl_send(cldev->cl, (u8 *)&req, sizeof(req),
> MEI_CL_IO_TX_BLOCKING);
> if (ret < 0) {
> dev_err(&cldev->dev, "Could not send ReqFWVersion cmd\n");
> @@ -188,7 +188,8 @@ static int mei_fwver(struct mei_cl_device *cldev)
> return -EIO;
> }
>
> - fwver = (struct mkhi_fw_ver *)req->data;
> + rsp = (struct mkhi_msg *)buf;
> + fwver = (struct mkhi_fw_ver *)rsp->data;
> memset(cldev->bus->fw_ver, 0, sizeof(cldev->bus->fw_ver));
> for (i = 0; i < MEI_MAX_FW_VER_BLOCKS; i++) {
> if ((size_t)bytes_recv < MKHI_FWVER_LEN(i + 1))
> @@ -329,16 +330,14 @@ static int mei_nfc_if_version(struct mei_cl *cl,
>
> WARN_ON(mutex_is_locked(&bus->device_lock));
>
> - ret = __mei_cl_send(cl, (u8 *)&cmd, sizeof(struct mei_nfc_cmd),
> - MEI_CL_IO_TX_BLOCKING);
> + ret = __mei_cl_send(cl, (u8 *)&cmd, sizeof(cmd), MEI_CL_IO_TX_BLOCKING);
> if (ret < 0) {
> dev_err(bus->dev, "Could not send IF version cmd\n");
> return ret;
> }
>
> /* to be sure on the stack we alloc memory */
> - if_version_length = sizeof(struct mei_nfc_reply) +
> - sizeof(struct mei_nfc_if_version);
> + if_version_length = sizeof(*reply) + sizeof(*ver);
>
> reply = kzalloc(if_version_length, GFP_KERNEL);
> if (!reply)
> @@ -352,7 +351,7 @@ static int mei_nfc_if_version(struct mei_cl *cl,
> goto err;
> }
>
> - memcpy(ver, reply->data, sizeof(struct mei_nfc_if_version));
> + memcpy(ver, reply->data, sizeof(*ver));
>
> dev_info(bus->dev, "NFC MEI VERSION: IVN 0x%x Vendor ID 0x%x Type
> 0x%x\n",
> ver->fw_ivn, ver->vendor_id, ver->radio_type);
> diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
> index f476dbc7252b..a6dfc3ce1db2 100644
> --- a/drivers/misc/mei/bus.c
> +++ b/drivers/misc/mei/bus.c
> @@ -931,7 +931,7 @@ static struct mei_cl_device *mei_cl_bus_dev_alloc(struct
> mei_device *bus,
> struct mei_cl_device *cldev;
> struct mei_cl *cl;
>
> - cldev = kzalloc(sizeof(struct mei_cl_device), GFP_KERNEL);
> + cldev = kzalloc(sizeof(*cldev), GFP_KERNEL);
> if (!cldev)
> return NULL;
>
>
