linux-stable.git/drivers/misc/mei, branch v3.14

mei: set client's read_cb to NULL when flow control fails

2014-02-18T18:07:36+00:00

In mei_cl_read_start(), if it fails to send flow control request, it
will release "cl->read_cb" but forget to set pointer to NULL, leaving
"cl->read_cb" still pointing to random memory, next time this client is
operated like mei_release(), it has chance to refer to this wrong pointer.

Fixes:  PANIC at kfree in mei_release()

[228781.826904] Call Trace:
[228781.829737]  [] ? mei_cl_unlink+0x48/0xa0
[228781.835283]  [] mei_io_cb_free+0x17/0x30
[228781.840733]  [] mei_release+0xa8/0x180
[228781.845989]  [] ? __fsnotify_parent+0xa0/0xf0
[228781.851925]  [] __fput+0xd9/0x200
[228781.856696]  [] ____fput+0xd/0x10
[228781.861467]  [] task_work_run+0x81/0xb0
[228781.866821]  [] do_exit+0x283/0xa00
[228781.871786]  [] ? kprobe_flush_task+0x66/0xc0
[228781.877722]  [] ? __dequeue_signal+0x18/0x1a0
[228781.883657]  [] ? dequeue_signal+0x32/0x190
[228781.889397]  [] do_group_exit+0x34/0xa0
[228781.894750]  [] get_signal_to_deliver+0x206/0x610
[228781.901075]  [] do_signal+0x38/0x100
[228781.906136]  [] ? mei_read+0x42c/0x4e0
[228781.911393]  [] ? wake_up_bit+0x30/0x30
[228781.916745]  [] ? mei_poll+0x120/0x120
[228781.922001]  [] ? vfs_read+0x89/0x160
[228781.927158]  [] ? mei_poll+0x120/0x120
[228781.932414]  [] ? fget_light+0x44/0xe0
[228781.937670]  [] ? SyS_read+0x68/0x80
[228781.942730]  [] do_notify_resume+0x55/0x70
[228781.948376]  [] work_notifysig+0x29/0x30
[228781.953827]  [] ? bad_area+0x5/0x3e

Cc: stable  # 3.9+
Signed-off-by: Chao Bi 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: don't unset read cb ptr on reset

2014-02-07T16:16:14+00:00

Don't set read callback to NULL during reset as
this leads to memory leak of both cb and its buffer.
The memory is correctly freed during mei_release.

The memory leak is detectable by kmemleak if
application has open read call while system is going through
suspend/resume.

unreferenced object 0xecead780 (size 64):
  comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
  hex dump (first 32 bytes):
    00 01 10 00 00 02 20 00 00 bf 30 f1 00 00 00 00  ...... ...0.....
    00 00 00 00 00 00 00 00 36 01 00 00 00 70 da e2  ........6....p..
  backtrace:
    [] kmemleak_alloc+0x3c/0xa0
    [] kmem_cache_alloc_trace+0xc6/0x190
    [] mei_io_cb_init+0x29/0x50
    [] mei_cl_read_start+0x102/0x360
    [] mei_read+0x103/0x4e0
    [] vfs_read+0x89/0x160
    [] SyS_read+0x4f/0x80
    [] syscall_call+0x7/0xb
    [] 0xffffffff
unreferenced object 0xe2da7000 (size 512):
  comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
  hex dump (first 32 bytes):
    00 6c da e2 7c 00 00 00 00 00 00 00 c0 eb 0c 59  .l..|..........Y
    1b 00 00 00 01 00 00 00 02 10 00 00 01 00 00 00  ................
  backtrace:
    [] kmemleak_alloc+0x3c/0xa0
    [] __kmalloc+0xe7/0x1d0
    [] mei_io_cb_alloc_resp_buf+0x2e/0x60
    [] mei_cl_read_start+0x12c/0x360
    [] mei_read+0x103/0x4e0
    [] vfs_read+0x89/0x160
    [] SyS_read+0x4f/0x80
    [] syscall_call+0x7/0xb
    [] 0xffffffff

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

mei: clear write cb from waiting list on reset

2014-02-07T16:16:14+00:00

Clear write callbacks sitting in write_waiting list on reset.
Otherwise these callbacks are left dangling and cause memory leak.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

mei: limit the number of consecutive resets

2014-01-13T22:57:21+00:00

give up reseting after 3 unsuccessful tries

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: revamp mei reset state machine

2014-01-13T22:57:21+00:00

1. MEI_DEV_RESETTING device state spans only hardware reset flow
while starting dev state is saved into a local variable for further
reference, this let us to reduce big if statements in case we
are trying to avoid nested resets

2. During initializations if the reset ended in MEI_DEV_DISABLED device
state we bail out with -ENODEV

3. Remove redundant interrupts_enabled parameter as this
 can be deduced from the starting dev_state

4. mei_reset propagates error code to the caller

5. Add mei_restart function to wrap the pci resume

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: fix syntax in comments and debug output

2014-01-08T23:28:27+00:00

Fix syntax errors in comments and debug strings

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: nfc: mei_nfc_free has to be called under lock

2014-01-08T23:27:42+00:00

nfc_nfc_free unlink clients from the device list
and has to be called under mei mutex

Signed-off-by: Tomas Winkler 
Reviewed-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: use hbm idle state to prevent spurious resets

2014-01-08T23:25:41+00:00

When reset is caused by hbm protocol mismatch or timeout
we might end up in an endless reset loop and hbm protocol
will never sync

Cc: 
Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: do not run reset flow from the interrupt thread

2014-01-08T23:25:15+00:00

This fixes a potential deadlock in case of a firmware
initiated reset

mei_reset has a dialog with the interrupt thread hence
it has to be run from an another work item

Most of the mei_resets were called from mei_hbm_dispatch
which is called in interrupt thread context so this
function underwent major revamp. The error code is
propagated to the interrupt thread and if needed
the reset is scheduled from there.

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: me: set dma mask using DMA mapping API

2013-12-19T00:39:54+00:00

ME device is 64bit DMA capable
We assume both coherent and consistent memory to match

Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman