patch "mei: bus: type promotion bug in mei_nfc_if_version()" added to char-misc-testing

This is a note to let you know that I've just added the patch titled

mei: bus: type promotion bug in mei_nfc_if_version()

to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-testing branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open.

If you have any questions about this process, please let me know.

From: Dan Carpenter <[email protected]>
Date: Wed, 11 Jul 2018 15:29:31 +0300
Subject: mei: bus: type promotion bug in mei_nfc_if_version()

We accidentally removed the check for negative returns without considering the issue of type promotion.
The "if_version_length" variable is type size_t so if __mei_cl_recv() returns a negative then "bytes_recv" is type promoted
to a high positive value and treated as success.

---
 drivers/misc/mei/bus-fixup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index e45fe826d87d..65e28be3c8cc 100644
@@ -341,7 +341,7 @@ static int mei_nfc_if_version(struct mei_cl *cl,
 
 	ret = 0;
 	bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length, 0, 0);
-	if (bytes_recv < if_version_length) {
+	if (bytes_recv < 0 || bytes_recv < if_version_length) {
 		dev_err(bus->dev, "Could not read IF version\n");
 		ret = -EIO;
 		goto err;

2.18.0