kernel/drivers/misc/mei/client.c, branch linux-5.1.y

mei: free read cb on ctrl_wr list flush

2019-01-30T14:24:45Z

There is a little window during disconnection flow when read cb is moved between lists and may be not freed. Remove moving read cbs explicitly during flash fixes this memory leak. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: dma ring: implement transmit flow

2018-11-26T15:59:48Z

Implement a circular buffer on allocated system memory. Read and write indices are stored on the control block which is also shared between the device and the host. Two new functions are exported from the DMA module: mei_dma_ring_write, and mei_dma_ring_empty_slots. The former simply copy a packet on the TX DMA circular buffer and later, returns the number of empty slots on the TX DMA circular buffer. Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman

mei: dma ring: implement rx circular buffer logic

2018-11-26T15:59:48Z

Implement circular buffer protocol over receive dma buffer. Add extension to the mei message header that holds length of the buffer on the dma buffer. Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman

mei: expedite ioctl return on the notify set operation error

2018-11-07T12:53:03Z

The notify set operation ioctl will wait till timeout is expired even in case when the FW returned an error. Check the status field of the client object in wait_event_timeout() to determine if the caller can return earlier. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: flush queues by the host client only

2018-11-07T12:53:03Z

During queues flush, the me client in most cases is already unlinked hence the me client id is unavailable. The host client structure pointer is enough for identification. The function mei_cl_cmp_id() is dropped as it has no more usage. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: fix use-after-free in mei_cl_write

2018-09-12T07:14:24Z

KASAN reports a use-after-free during startup, in mei_cl_write: BUG: KASAN: use-after-free in mei_cl_write+0x601/0x870 [mei] (drivers/misc/mei/client.c:1770) This is caused by commit 98e70866aacb ("mei: add support for variable length mei headers."), which changed the return value from len, to buf->size. That ends up using a stale buf pointer, because blocking call, the cb (callback) is deleted in me_cl_complete() function. However, fortunately, len remains unchanged throughout the function (and I don't see anything else that would require re-reading buf->size either), so the fix is to simply revert the change, and return len, as before. Fixes: 98e70866aacb ("mei: add support for variable length mei headers.") CC: Arnd Bergmann CC: Greg Kroah-Hartman Signed-off-by: John Hubbard Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: hbm: introduce dma bit in the message header

2018-08-02T08:18:30Z

Add dma_ring bit in the mei message header for conveying that the message data itself are on the dma ring. Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman

mei: add support for variable length mei headers.

2018-08-02T08:18:29Z

Remove header size knowledge from me and txe hw layers, this requires to change the write handler to accept header and its length as well as data and its length. HBM messages are fixed to use basic header, hence we add mei_hbm2slots() that converts HBM message length and mei message header, while mei_data2slots() converts data length directly to the slots. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: add mei_msg_hdr_init wrapper.

2018-07-24T12:16:57Z

Wrap the mei header boilerplate initialization code in mei_msg_hdr_init function. On the way remove 'completed' field from mei_cl_cb structure as this information is already included in the header and is local to particular fragment. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: move hbuf_depth from the mei device to the hw modules

2018-07-24T12:16:57Z

The host buffer depth is hardware specific so it's better to handle it inside the me and txe hw modules. In me the depth is read from register in txe it's a constant number. The value is now retrieved via mei_hbuf_depth accessor, while it replaces mei_hbuf_max_len. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman