Commit bb29fc32 authored by Alexander Usyskin's avatar Alexander Usyskin Committed by Greg Kroah-Hartman
Browse files

mei: make a local copy of client uuid in connect 



Connect ioctl has the same memory for in and out parameters.
Copy in parameter (client uuid) to the local stack to avoid it be
overwritten by out parameters fill.

Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20250918130435.3327400-3-alexander.usyskin@intel.com
parent 2cedb296

drivers/misc/mei/main.c

+9 −9
Original line number Diff line number Diff line
@@ -646,7 +646,7 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data) 
	struct mei_cl *cl = file->private_data;

	struct mei_connect_client_data conn;

	struct mei_connect_client_data_vtag conn_vtag;

	const uuid_le *cl_uuid;

	uuid_le cl_uuid;

	struct mei_client *props;

	u8 vtag;

	u32 notify_get, notify_req;
@@ -674,18 +674,18 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data) 
			rets = -EFAULT;

			goto out;

		}

		cl_uuid = &conn.in_client_uuid;

		cl_uuid = conn.in_client_uuid;

		props = &conn.out_client_properties;

		vtag = 0;



		rets = mei_vt_support_check(dev, cl_uuid);

		rets = mei_vt_support_check(dev, &cl_uuid);

		if (rets == -ENOTTY)

			goto out;

		if (!rets)

			rets = mei_ioctl_connect_vtag(file, cl_uuid, props,

			rets = mei_ioctl_connect_vtag(file, &cl_uuid, props,

						      vtag);

		else

			rets = mei_ioctl_connect_client(file, cl_uuid, props);

			rets = mei_ioctl_connect_client(file, &cl_uuid, props);

		if (rets)

			goto out;
@@ -707,14 +707,14 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data) 
			goto out;

		}



		cl_uuid = &conn_vtag.connect.in_client_uuid;

		cl_uuid = conn_vtag.connect.in_client_uuid;

		props = &conn_vtag.out_client_properties;

		vtag = conn_vtag.connect.vtag;



		rets = mei_vt_support_check(dev, cl_uuid);

		rets = mei_vt_support_check(dev, &cl_uuid);

		if (rets == -EOPNOTSUPP)

			cl_dbg(dev, cl, "FW Client %pUl does not support vtags\n",

				cl_uuid);

				&cl_uuid);

		if (rets)

			goto out;
@@ -724,7 +724,7 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data) 
			goto out;

		}



		rets = mei_ioctl_connect_vtag(file, cl_uuid, props, vtag);

		rets = mei_ioctl_connect_vtag(file, &cl_uuid, props, vtag);

		if (rets)

			goto out;