diff options
| author | Tomas Winkler <tomas.winkler@intel.com> | 2020-02-11 17:05:22 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-02-11 23:03:19 +0100 |
| commit | 3aef021b2df7d8440225a53460c0d34b140297d5 (patch) | |
| tree | cef331537a1db05d2ba8f39ac50db76efe06c26e /drivers/misc/mei/hw.h | |
| parent | mei: bus: replace zero-length array with flexible-array member (diff) | |
| download | linux-3aef021b2df7d8440225a53460c0d34b140297d5.tar.xz linux-3aef021b2df7d8440225a53460c0d34b140297d5.zip | |
mei: limit number of bytes in mei header.
The MEI message header provides only 9 bits for storing
the message size, limiting to 511.
In theory the host buffer (hbuf) can contain up to 1020 bytes
(limited by byte = 255 * 4)
With the current hardware and hbuf size 512, this is not a real issue,
but as hardening approach we enforce the limit.
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20200211160522.7562-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/misc/mei/hw.h')
| -rw-r--r-- | drivers/misc/mei/hw.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/misc/mei/hw.h b/drivers/misc/mei/hw.h index d025a5f8317e..8231b6941adf 100644 --- a/drivers/misc/mei/hw.h +++ b/drivers/misc/mei/hw.h @@ -209,6 +209,9 @@ struct mei_msg_hdr { u32 extension[0]; } __packed; +/* The length is up to 9 bits */ +#define MEI_MSG_MAX_LEN_MASK GENMASK(9, 0) + #define MEI_MSG_HDR_MAX 2 struct mei_bus_message { |