Patch "mei: bus: fix received data size check in NFC fixup" has been added to the 4.8-stable tree

This is a note to let you know that I've just added the patch titled

mei: bus: fix received data size check in NFC fixup

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mei-bus-fix-received-data-size-check-in-nfc-fixup.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Alexander Usyskin <[email protected]>
Date: Mon, 31 Oct 2016 19:02:39 +0200
Subject: mei: bus: fix received data size check in NFC fixup

From: Alexander Usyskin <[email protected]>

commit 582ab27a063a506ccb55fc48afcc325342a2deba upstream.

NFC version reply size checked against only header size, not against full message size. That may lead potentially to uninitialized memory access in version data.

That leads to warnings when version data is accessed:
drivers/misc/mei/bus-fixup.c: warning: '*((void *)&ver+11)' may be used uninitialized in this function [-Wuninitialized]: => 212:2

Reported in
Build regressions/improvements in v4.9-rc3
https://lkml.org/lkml/2016/10/30/57

---
 drivers/misc/mei/bus-fixup.c |    2 +-
 drivers/nfc/mei_phy.c        |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

@@ -178,7 +178,7 @@ static int mei_nfc_if_version(struct mei
 
 	ret = 0;
 	bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length);
-	if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
+	if (bytes_recv < if_version_length) {
 		dev_err(bus->dev, "Could not read IF version\n");
 		ret = -EIO;
 		goto err;

@@ -133,7 +133,7 @@ static int mei_nfc_if_version(struct nfc
 		return -ENOMEM;
 
 	bytes_recv = mei_cldev_recv(phy->cldev, (u8 *)reply, if_version_length);
-	if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
+	if (bytes_recv < 0 || bytes_recv < if_version_length) {
 		pr_err("Could not read IF version\n");
 		r = -EIO;
 		goto err;

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/mei-bus-fix-received-data-size-check-in-nfc-fixup.patch