diff mbox series

[4.9,46/78] mei: protect mei_cl_mtu from null dereference

Message ID	20201117122111.361911058@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Alexander Usyskin <alexander.usyskin@intel.com>, Tomas Winkler <tomas.winkler@intel.com> Subject: [PATCH 4.9 46/78] mei: protect mei_cl_mtu from null dereference Date: Tue, 17 Nov 2020 14:05:12 +0100 Message-Id: <20201117122111.361911058@linuxfoundation.org> In-Reply-To: <20201117122109.116890262@linuxfoundation.org> References: <20201117122109.116890262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,02/78] ring-buffer: Fix recursion protection transitions between interrupt context [4.9,04/78] mm: mempolicy: fix potential pte_unmap_unlock pte error [4.9,05/78] time: Prevent undefined behaviour in timespec64_to_ns() [4.9,07/78] genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY [4.9,11/78] can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context [4.9,12/78] can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames [4.9,15/78] can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping [4.9,16/78] xfs: flush new eof page on truncate to avoid post-eof corruption [4.9,18/78] pinctrl: devicetree: Avoid taking direct reference to device name string [4.9,22/78] i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c [4.9,23/78] i40e: Memory leak in i40e_config_iwarp_qvlist [4.9,25/78] ath9k_htc: Use appropriate rs_datalen type [4.9,28/78] gfs2: check for live vs. read-only file system in gfs2_fitrim [4.9,29/78] scsi: hpsa: Fix memory leak in hpsa_init_one() [4.9,30/78] drm/amdgpu: perform srbm soft reset always on SDMA resume [4.9,31/78] mac80211: fix use of skb payload instead of header [4.9,34/78] scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() [4.9,35/78] iommu/amd: Increase interrupt remapping table limit to 512 entries [4.9,36/78] pinctrl: aspeed: Fix GPI only function problem. [4.9,40/78] of/address: Fix of_node memory leak in of_dma_is_coherent [4.9,41/78] cosa: Add missing kfree in error path of cosa_write [4.9,43/78] ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA [4.9,44/78] ext4: unlock xattr_sem properly in ext4_inline_data_truncate() [4.9,46/78] mei: protect mei_cl_mtu from null dereference [4.9,47/78] ocfs2: initialize ip_next_orphan [4.9,48/78] dont dump the threads that had been already exiting when zapped. [4.9,52/78] swiotlb: fix "x86: Dont panic if can not alloc buffer for swiotlb" [4.9,54/78] net/af_iucv: fix null pointer dereference on shutdown [4.9,56/78] net: Update window_clamp if SOCK_RCVBUF is set [4.9,59/78] perf/core: Fix bad use of igrab() [4.9,60/78] perf/core: Fix crash when using HW tracing kernel filters [4.9,63/78] xen/events: add a proper barrier to 2-level uevent unmasking [4.9,64/78] xen/events: fix race in evtchn_fifo_unmask() [4.9,65/78] xen/events: add a new "late EOI" evtchn framework [4.9,68/78] xen/scsiback: use lateeoi irq binding [4.9,69/78] xen/pciback: use lateeoi irq binding [4.9,71/78] xen/events: use a common cpu hotplug hook for event channels [4.9,72/78] xen/events: defer eoi in case of excessive number of events [4.9,75/78] Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" [4.9,77/78] ext4: fix leaking sysfs kobject after failed mount

Commit Message

Greg KH Nov. 17, 2020, 1:05 p.m. UTC

From: Alexander Usyskin <alexander.usyskin@intel.com>

commit bcbc0b2e275f0a797de11a10eff495b4571863fc upstream.

A receive callback is queued while the client is still connected
but can still be called after the client was disconnected. Upon
disconnect cl->me_cl is set to NULL, hence we need to check
that ME client is not-NULL in mei_cl_mtu to avoid
null dereference.

Cc: <stable@vger.kernel.org>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20201029095444.957924-2-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/mei/client.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff mbox series

Patch

--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -152,11 +152,11 @@  static inline u8 mei_cl_me_id(const stru
  *
  * @cl: host client
  *
- * Return: mtu
+ * Return: mtu or 0 if client is not connected
  */
 static inline size_t mei_cl_mtu(const struct mei_cl *cl)
 {
-	return cl->me_cl->props.max_msg_length;
+	return cl->me_cl ? cl->me_cl->props.max_msg_length : 0;
 }
 
 /**