diff options
| author |   Tomas Winkler <tomas.winkler@intel.com> | 2013-09-02 03:11:01 +0300 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-09-26 08:23:00 -0700 |
| commit | 23f5a322063cba7c9f5dba5205e2960a24291373 (patch) | |
| tree | 3df53fb4fda1498c03714330f63c1352af326deb /drivers/misc/mei/hbm.c | |
| parent | mei: mei_cl_link protect open_handle_count from overflow (diff) | |
| download | linux-dev-23f5a322063cba7c9f5dba5205e2960a24291373.tar.xz linux-dev-23f5a322063cba7c9f5dba5205e2960a24291373.zip | |
mei: make sure that me_clients_map big enough before copying
To make static analyzers happy validated that
sizeof me_clients_map is larger than sizeof valid_addresses from the
enumeration response before memcpy
We can use BUILD_ON macro as both arrays are defined statically
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to '')
| -rw-r--r-- | drivers/misc/mei/hbm.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c index 6127ab64bb39..95d4dabf82c0 100644 --- a/drivers/misc/mei/hbm.c +++ b/drivers/misc/mei/hbm.c @@ -673,7 +673,10 @@ void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr) case HOST_ENUM_RES_CMD: enum_res = (struct hbm_host_enum_response *) mei_msg; - memcpy(dev->me_clients_map, enum_res->valid_addresses, 32); + BUILD_BUG_ON(sizeof(dev->me_clients_map) + < sizeof(enum_res->valid_addresses)); + memcpy(dev->me_clients_map, enum_res->valid_addresses, + sizeof(enum_res->valid_addresses)); if (dev->dev_state == MEI_DEV_INIT_CLIENTS && dev->hbm_state == MEI_HBM_ENUM_CLIENTS) { dev->init_clients_timer = 0; |