kernel/linux.git/drivers/misc/mei/client.c, branch linux-4.20.y

mei: fix use-after-free in mei_cl_write

2018-09-12T07:14:24+00:00

KASAN reports a use-after-free during startup, in mei_cl_write: BUG: KASAN: use-after-free in mei_cl_write+0x601/0x870 [mei] (drivers/misc/mei/client.c:1770) This is caused by commit 98e70866aacb ("mei: add support for variable length mei headers."), which changed the return value from len, to buf->size. That ends up using a stale buf pointer, because blocking call, the cb (callback) is deleted in me_cl_complete() function. However, fortunately, len remains unchanged throughout the function (and I don't see anything else that would require re-reading buf->size either), so the fix is to simply revert the change, and return len, as before. Fixes: 98e70866aacb ("mei: add support for variable length mei headers.") CC: Arnd Bergmann CC: Greg Kroah-Hartman Signed-off-by: John Hubbard Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: hbm: introduce dma bit in the message header

2018-08-02T08:18:30+00:00

Add dma_ring bit in the mei message header for conveying that the message data itself are on the dma ring. Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman

mei: add support for variable length mei headers.

2018-08-02T08:18:29+00:00

Remove header size knowledge from me and txe hw layers, this requires to change the write handler to accept header and its length as well as data and its length. HBM messages are fixed to use basic header, hence we add mei_hbm2slots() that converts HBM message length and mei message header, while mei_data2slots() converts data length directly to the slots. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: add mei_msg_hdr_init wrapper.

2018-07-24T12:16:57+00:00

Wrap the mei header boilerplate initialization code in mei_msg_hdr_init function. On the way remove 'completed' field from mei_cl_cb structure as this information is already included in the header and is local to particular fragment. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: move hbuf_depth from the mei device to the hw modules

2018-07-24T12:16:57+00:00

The host buffer depth is hardware specific so it's better to handle it inside the me and txe hw modules. In me the depth is read from register in txe it's a constant number. The value is now retrieved via mei_hbuf_depth accessor, while it replaces mei_hbuf_max_len. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: cleanup slots to data conversions

2018-07-24T12:16:57+00:00

Cleanup conversions between slots and data. Define MEI_SLOT_SIZE instead of using 4 or sizeof(u32) across the source code. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: fix ssize_t to int assignment in read and write ops.

2018-07-12T14:23:19+00:00

Use ssize_t for rets variables in mei_write(), mei_read(), and mei_cl_write() as well as change the return type of mei_cl_write() to ssize_t, to prevent assignment of possible 64bit size_t to int 32 bit variable. As by product also eliminate warning drivers/misc/mei/client.c:1702:11: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: check for error returned from mei_hbuf_empty_slots()

2018-07-12T14:23:19+00:00

mei_hbuf_empty_slots() may return with an error in case of circular buffer overflow. This type of error may be caused only by a bug. However currently, the error won't be detected due signed type promotion in comparison to u32. We add explicit check for less then zero and explicit cast in comparison to suppress singn-compare warning. Reported-by: Dan Carpenter Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: limit the number of queued writes

2018-03-14T18:33:13+00:00

Limit the number of queued writes per client. Writes above this threshold are blocked till place in the transmit queue is available. The limit is configurable via sysfs and defaults to 50. The implementation should provide blocking I/O behavior. Prior to this change one would end up in the hands of OOM. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman

mei: make module referencing local to the bus.c

2018-03-14T18:33:13+00:00

Module reference counting is relevant only to the mei client devices. Make the implementation clean and move it to bus.c Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman