linux-stable.git/drivers/misc/mei, branch linux-3.13.y

mei: set client's read_cb to NULL when flow control fails

2014-03-07T06:06:24+00:00

commit accb884b32e82f943340688c9cd30290531e73e0 upstream.

In mei_cl_read_start(), if it fails to send flow control request, it
will release "cl->read_cb" but forget to set pointer to NULL, leaving
"cl->read_cb" still pointing to random memory, next time this client is
operated like mei_release(), it has chance to refer to this wrong pointer.

Fixes:  PANIC at kfree in mei_release()

[228781.826904] Call Trace:
[228781.829737]  [] ? mei_cl_unlink+0x48/0xa0
[228781.835283]  [] mei_io_cb_free+0x17/0x30
[228781.840733]  [] mei_release+0xa8/0x180
[228781.845989]  [] ? __fsnotify_parent+0xa0/0xf0
[228781.851925]  [] __fput+0xd9/0x200
[228781.856696]  [] ____fput+0xd/0x10
[228781.861467]  [] task_work_run+0x81/0xb0
[228781.866821]  [] do_exit+0x283/0xa00
[228781.871786]  [] ? kprobe_flush_task+0x66/0xc0
[228781.877722]  [] ? __dequeue_signal+0x18/0x1a0
[228781.883657]  [] ? dequeue_signal+0x32/0x190
[228781.889397]  [] do_group_exit+0x34/0xa0
[228781.894750]  [] get_signal_to_deliver+0x206/0x610
[228781.901075]  [] do_signal+0x38/0x100
[228781.906136]  [] ? mei_read+0x42c/0x4e0
[228781.911393]  [] ? wake_up_bit+0x30/0x30
[228781.916745]  [] ? mei_poll+0x120/0x120
[228781.922001]  [] ? vfs_read+0x89/0x160
[228781.927158]  [] ? mei_poll+0x120/0x120
[228781.932414]  [] ? fget_light+0x44/0xe0
[228781.937670]  [] ? SyS_read+0x68/0x80
[228781.942730]  [] do_notify_resume+0x55/0x70
[228781.948376]  [] work_notifysig+0x29/0x30
[228781.953827]  [] ? bad_area+0x5/0x3e

Signed-off-by: Chao Bi 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: don't unset read cb ptr on reset

2014-02-22T21:34:53+00:00

commit 5cb906c7035f03a3a44fecece9d3ff8fcc75d6e0 upstream.

Don't set read callback to NULL during reset as
this leads to memory leak of both cb and its buffer.
The memory is correctly freed during mei_release.

The memory leak is detectable by kmemleak if
application has open read call while system is going through
suspend/resume.

unreferenced object 0xecead780 (size 64):
  comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
  hex dump (first 32 bytes):
    00 01 10 00 00 02 20 00 00 bf 30 f1 00 00 00 00  ...... ...0.....
    00 00 00 00 00 00 00 00 36 01 00 00 00 70 da e2  ........6....p..
  backtrace:
    [] kmemleak_alloc+0x3c/0xa0
    [] kmem_cache_alloc_trace+0xc6/0x190
    [] mei_io_cb_init+0x29/0x50
    [] mei_cl_read_start+0x102/0x360
    [] mei_read+0x103/0x4e0
    [] vfs_read+0x89/0x160
    [] SyS_read+0x4f/0x80
    [] syscall_call+0x7/0xb
    [] 0xffffffff
unreferenced object 0xe2da7000 (size 512):
  comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
  hex dump (first 32 bytes):
    00 6c da e2 7c 00 00 00 00 00 00 00 c0 eb 0c 59  .l..|..........Y
    1b 00 00 00 01 00 00 00 02 10 00 00 01 00 00 00  ................
  backtrace:
    [] kmemleak_alloc+0x3c/0xa0
    [] __kmalloc+0xe7/0x1d0
    [] mei_io_cb_alloc_resp_buf+0x2e/0x60
    [] mei_cl_read_start+0x12c/0x360
    [] mei_read+0x103/0x4e0
    [] vfs_read+0x89/0x160
    [] SyS_read+0x4f/0x80
    [] syscall_call+0x7/0xb
    [] 0xffffffff

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: clear write cb from waiting list on reset

2014-02-22T21:34:52+00:00

commit 30c54df7cb9b15b222529a028390b9c9582dd65e upstream.

Clear write callbacks sitting in write_waiting list on reset.
Otherwise these callbacks are left dangling and cause memory leak.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: mei_hbm_dispatch() returns void

2014-02-13T21:55:26+00:00

Building hbm.o for v3.13.2 triggers a GCC warning:
    drivers/misc/mei/hbm.c: In function 'mei_hbm_dispatch':
    drivers/misc/mei/hbm.c:596:3: warning: 'return' with a value, in function returning void [enabled by default]
       return 0;
       ^

GCC is correct, obviously. So let's return void instead of zero here.

Signed-off-by: Paul Bolle 
Acked-by: Tomas Winkler 
Cc: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: use hbm idle state to prevent spurious resets

2014-02-06T19:33:58+00:00

commit 66ae460b13c31a176b41550259683c841a62af3e upstream.

When reset is caused by hbm protocol mismatch or timeout
we might end up in an endless reset loop and hbm protocol
will never sync

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: add 9 series PCH mei device ids

2013-12-05T17:48:23+00:00

And Lynx Point H Refresh and Wildcat Point LP
device ids.

Signed-off-by: Tomas Winkler 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

mei: wd: host_init propagate error codes from called functions

2013-10-29T23:20:43+00:00

Propagate error codes from called functions, they are correct.

Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: replace stray pr_debug with dev_dbg

2013-10-29T23:20:43+00:00

Driver better use dev_dbg, not pr_debug.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: bus: propagate error code returned by mei_me_cl_by_id

2013-10-29T23:20:43+00:00

no need to change error code value returned by
mei_me_cl_by_id, just propagate it on

Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: mei_cl_link remove duplicated check for open_handle_count

2013-10-29T23:20:43+00:00

Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman