BMC/Intel-BMC/linux.git/drivers/misc/mei/client.c, branch dev-4.6

mei: fix NULL dereferencing during FW initiated disconnection

2016-06-01T19:18:00+00:00

commit 6a8d648c8d1824117a9e9edb948ed1611fb013c0 upstream. In the case when disconnection is initiated from the FW the driver is flushing items from the write control list while iterating over it: mei_irq_write_handler() list_for_each_entry_safe(ctrl_wr_list) <-- outer loop mei_cl_irq_disconnect_rsp() mei_cl_set_disconnected() mei_io_list_flush(ctrl_wr_list) <-- destorying list We move the list flushing to the completion routine. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: fix format string in debug prints

2016-02-20T22:27:36+00:00

buf_idx type was changed to size_t, and few places missed out to change the print format from %ld to %zu. Use also uz for buf.size which is also of size_t Fixes: commit 56988f22e097 ("mei: fix possible integer overflow issue")' Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: fix double freeing of a cb during link reset

2016-02-12T03:23:28+00:00

Fix double freeing of the cb that can happen if link reset kicks in the middle of blocked write from a device on the cl bus. Free cb inside mei_cl_write function on failure and drop cb free operation from callers, during a link reset the mei_cl_write function returns with an error, but the caller doesn't know if the cb was already queued or not so it doesn't know if the cb will be freed upon queue reclaim or it has to free it itself. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: split amthif client init from end of clients enumeration

2016-02-07T22:47:20+00:00

The amthif FW client can appear after the end of client enumeration. Amthif host client initialization is done now at FW client discovery time. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: drop reserved host client ids

2016-02-07T22:47:20+00:00

The reserved host clients can be obsoleted now, a portion of the platforms is shipped without iAMT enabled, where the reservation is not relevant and for platforms with iAMT dynamic allocation is sufficient. Dropping reserved ids makes enumeration more flexible and generic Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: fill file pointer in read cb for fixed address client

2016-02-07T22:47:20+00:00

The read callback created from a flow control request for a fixed address client have NULL in the file pointer. Fill the file pointer using a data from a write callback. This allows us to drop workaround introduced in: commit eeabfcf5a92a ("mei: connection to fixed address clients from user-space") Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: clean write queues and wake waiters on disconnect

2016-02-07T22:47:20+00:00

Clean write and write_waiting queues in disconnect. Requests in those queues are stale and processing will lead to fat warnings. In multi thread operations on disconnect and in FW disconnect case - write/read/event waiters should end wait and return error. Wake all waiters for disconnecting client to achieve that. Drop wake all and write queue clean on reset, as now we waking all waiters and cleaning write queues on disconnect. No need to do it twice. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: wake blocked write on link reset

2016-02-07T22:47:20+00:00

In case of link reset all blocked writes should be interrupted. Note, that currently blocking write is used only through bus layer. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: bus: fix notification event delivery

2016-02-07T22:47:20+00:00

Call wake_up cl->ev_wait only in case there is no bus client registered to the event notification. Second, since we don't have exclusive waiter wake_up_interruptible_all is not used correctly here. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: bus: fix RX event scheduling

2016-02-07T22:47:20+00:00

In this particular case this more correct and safer to check if the RX event is set in the event mask rather than query waitqueue_active Since the check is already performed in the mei_cl_bus_rx_event function, it is just required to check for its return value. Second, since we don't have exclusive waiter wake_up_interruptible_all is not used correctly here. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman