linux-stable.git/drivers/misc, branch linux-3.13.y

mei: set client's read_cb to NULL when flow control fails

2014-03-07T06:06:24+00:00

commit accb884b32e82f943340688c9cd30290531e73e0 upstream.

In mei_cl_read_start(), if it fails to send flow control request, it
will release "cl->read_cb" but forget to set pointer to NULL, leaving
"cl->read_cb" still pointing to random memory, next time this client is
operated like mei_release(), it has chance to refer to this wrong pointer.

Fixes:  PANIC at kfree in mei_release()

[228781.826904] Call Trace:
[228781.829737]  [] ? mei_cl_unlink+0x48/0xa0
[228781.835283]  [] mei_io_cb_free+0x17/0x30
[228781.840733]  [] mei_release+0xa8/0x180
[228781.845989]  [] ? __fsnotify_parent+0xa0/0xf0
[228781.851925]  [] __fput+0xd9/0x200
[228781.856696]  [] ____fput+0xd/0x10
[228781.861467]  [] task_work_run+0x81/0xb0
[228781.866821]  [] do_exit+0x283/0xa00
[228781.871786]  [] ? kprobe_flush_task+0x66/0xc0
[228781.877722]  [] ? __dequeue_signal+0x18/0x1a0
[228781.883657]  [] ? dequeue_signal+0x32/0x190
[228781.889397]  [] do_group_exit+0x34/0xa0
[228781.894750]  [] get_signal_to_deliver+0x206/0x610
[228781.901075]  [] do_signal+0x38/0x100
[228781.906136]  [] ? mei_read+0x42c/0x4e0
[228781.911393]  [] ? wake_up_bit+0x30/0x30
[228781.916745]  [] ? mei_poll+0x120/0x120
[228781.922001]  [] ? vfs_read+0x89/0x160
[228781.927158]  [] ? mei_poll+0x120/0x120
[228781.932414]  [] ? fget_light+0x44/0xe0
[228781.937670]  [] ? SyS_read+0x68/0x80
[228781.942730]  [] do_notify_resume+0x55/0x70
[228781.948376]  [] work_notifysig+0x29/0x30
[228781.953827]  [] ? bad_area+0x5/0x3e

Signed-off-by: Chao Bi 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

misc: mic: fix possible signed underflow (undefined behavior) in userspace API

2014-02-22T21:34:57+00:00

commit 3b1cc9b9622a022208ec95b1259b05bbdf712eb7 upstream.

iovcnt is declared as a signed integer in both the userspace API and
as a local variable in mic_virtio.c. The while() loop in mic_virtio.c
iterates until the local variable iovcnt reaches the value 0. If
userspace passes e.g. INT_MIN as iovcnt field, this loop then appears
to depend on an undefined behavior (signed underflow) to complete.
The fix is to use unsigned integers in both the userspace API and
the local variable.

This issue was reported @ https://lkml.org/lkml/2014/1/10/10

Reported-by: Mathieu Desnoyers 
Reviewed-by: Ashutosh Dixit 
Signed-off-by: Sudeep Dutt 
Signed-off-by: Greg Kroah-Hartman

mei: don't unset read cb ptr on reset

2014-02-22T21:34:53+00:00

commit 5cb906c7035f03a3a44fecece9d3ff8fcc75d6e0 upstream.

Don't set read callback to NULL during reset as
this leads to memory leak of both cb and its buffer.
The memory is correctly freed during mei_release.

The memory leak is detectable by kmemleak if
application has open read call while system is going through
suspend/resume.

unreferenced object 0xecead780 (size 64):
  comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
  hex dump (first 32 bytes):
    00 01 10 00 00 02 20 00 00 bf 30 f1 00 00 00 00  ...... ...0.....
    00 00 00 00 00 00 00 00 36 01 00 00 00 70 da e2  ........6....p..
  backtrace:
    [] kmemleak_alloc+0x3c/0xa0
    [] kmem_cache_alloc_trace+0xc6/0x190
    [] mei_io_cb_init+0x29/0x50
    [] mei_cl_read_start+0x102/0x360
    [] mei_read+0x103/0x4e0
    [] vfs_read+0x89/0x160
    [] SyS_read+0x4f/0x80
    [] syscall_call+0x7/0xb
    [] 0xffffffff
unreferenced object 0xe2da7000 (size 512):
  comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
  hex dump (first 32 bytes):
    00 6c da e2 7c 00 00 00 00 00 00 00 c0 eb 0c 59  .l..|..........Y
    1b 00 00 00 01 00 00 00 02 10 00 00 01 00 00 00  ................
  backtrace:
    [] kmemleak_alloc+0x3c/0xa0
    [] __kmalloc+0xe7/0x1d0
    [] mei_io_cb_alloc_resp_buf+0x2e/0x60
    [] mei_cl_read_start+0x12c/0x360
    [] mei_read+0x103/0x4e0
    [] vfs_read+0x89/0x160
    [] SyS_read+0x4f/0x80
    [] syscall_call+0x7/0xb
    [] 0xffffffff

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: clear write cb from waiting list on reset

2014-02-22T21:34:52+00:00

commit 30c54df7cb9b15b222529a028390b9c9582dd65e upstream.

Clear write callbacks sitting in write_waiting list on reset.
Otherwise these callbacks are left dangling and cause memory leak.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: mei_hbm_dispatch() returns void

2014-02-13T21:55:26+00:00

Building hbm.o for v3.13.2 triggers a GCC warning:
    drivers/misc/mei/hbm.c: In function 'mei_hbm_dispatch':
    drivers/misc/mei/hbm.c:596:3: warning: 'return' with a value, in function returning void [enabled by default]
       return 0;
       ^

GCC is correct, obviously. So let's return void instead of zero here.

Signed-off-by: Paul Bolle 
Acked-by: Tomas Winkler 
Cc: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

misc: mic: bug fix for interrupt acknowledgement in MSI/INTx case.

2014-02-06T19:34:01+00:00

commit df5e4e8b576108f88f79e5b4c984d51d460d2360 upstream.

The interrupt handler (mic_interrupt), called in the MSI/INTx mode,
writes to the interrupt sources register to acknowledge the
interrupt and then calls the corresponding callback handlers to handle
the same. These callback handlers acknowledge the interrupts again
leading to missed interrupts. This patch fixes the issue by removing
the interrupt acknowlegment code from the callback handlers.

Reviewed-by: Sudeep Dutt 
Reviewed-by: Nikhil Rao 
Reviewed-by: Siva Krishna Kumar Reddy Yerramreddy 
Signed-off-by: Dasaratharaman Chandramouli 
Signed-off-by: Greg Kroah-Hartman

mei: use hbm idle state to prevent spurious resets

2014-02-06T19:33:58+00:00

commit 66ae460b13c31a176b41550259683c841a62af3e upstream.

When reset is caused by hbm protocol mismatch or timeout
we might end up in an endless reset loop and hbm protocol
will never sync

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'char-misc-3.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2013-12-09T02:47:25+00:00

Pull char/misc driver fixes from Greg KH:
 "Nothing huge, just a few small bugfixes for problems reported, and a
  device id update"

* tag 'char-misc-3.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  mei: add 9 series PCH mei device ids
  drivers/char/i8k.c: add Dell XPLS L421X
  MAINTAINERS: add HSI subsystem
  misc: mic: Suppress memory space sparse warnings
  misc: mic: Fix endianness issues.
  misc: mic: Fix user space namespace pollution from mic_common.h.
  misc: mic: Bug fix for sysfs poll usage.
  misc: mic: Minor bug fix in 'retry' loops.
  misc: mic: Change mic_notify(...) to return true.
  extcon: remove freed groups caused the panic or warning in unregister flow
  extcon: arizona: Get pdata from arizona structure not device

mei: add 9 series PCH mei device ids

2013-12-05T17:48:23+00:00

And Lynx Point H Refresh and Wildcat Point LP
device ids.

Signed-off-by: Tomas Winkler 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

[SCSI] enclosure: fix WARN_ON in dual path device removing

2013-12-02T19:13:14+00:00

Bug report from: wenxiong@linux.vnet.ibm.com

The issue is happened in dual controller configuration. We got the
sysfs warnings when rmmod the ipr module.

enclosure_unregister() in drivers/msic/enclosure.c, call device_unregister()
for each componment deivce, device_unregister() ->device_del()->kobject_del()
->sysfs_remove_dir(). In sysfs_remove_dir(), set kobj->sd = NULL.

For each componment device,
enclosure_component_release()->enclosure_remove_links()->sysfs_remove_link()
in which checking kobj->sd again, it has been set as NULL when doing
device_unregister. So we saw all these sysfs WARNING.

Tested-by: wenxiong@linux.vnet.ibm.com
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley