Commit 23253c31 authored by Alexander Usyskin's avatar Alexander Usyskin Committed by Greg Kroah-Hartman

mei: do not access freed cb in blocking write

The mei_cl_write function is giving up on a write cb ownership after it
was sent or queued. The write cb is then freed in the completion
handler. Especially during blocking write mei_cl_write function waits
for the completion handler and then access the freed memory to fetch the
written size.  The quick fix is to store the buffer size prior to
sending, the size is not altered during the flow.
Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0bd38ae3
...@@ -1356,6 +1356,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) ...@@ -1356,6 +1356,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
struct mei_device *dev; struct mei_device *dev;
struct mei_msg_data *buf; struct mei_msg_data *buf;
struct mei_msg_hdr mei_hdr; struct mei_msg_hdr mei_hdr;
int size;
int rets; int rets;
...@@ -1367,10 +1368,10 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) ...@@ -1367,10 +1368,10 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
dev = cl->dev; dev = cl->dev;
buf = &cb->buf; buf = &cb->buf;
size = buf->size;
cl_dbg(dev, cl, "size=%d\n", buf->size); cl_dbg(dev, cl, "size=%d\n", size);
rets = pm_runtime_get(dev->dev); rets = pm_runtime_get(dev->dev);
if (rets < 0 && rets != -EINPROGRESS) { if (rets < 0 && rets != -EINPROGRESS) {
...@@ -1394,21 +1395,21 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) ...@@ -1394,21 +1395,21 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
if (rets == 0) { if (rets == 0) {
cl_dbg(dev, cl, "No flow control credentials: not sending.\n"); cl_dbg(dev, cl, "No flow control credentials: not sending.\n");
rets = buf->size; rets = size;
goto out; goto out;
} }
if (!mei_hbuf_acquire(dev)) { if (!mei_hbuf_acquire(dev)) {
cl_dbg(dev, cl, "Cannot acquire the host buffer: not sending.\n"); cl_dbg(dev, cl, "Cannot acquire the host buffer: not sending.\n");
rets = buf->size; rets = size;
goto out; goto out;
} }
/* Check for a maximum length */ /* Check for a maximum length */
if (buf->size > mei_hbuf_max_len(dev)) { if (size > mei_hbuf_max_len(dev)) {
mei_hdr.length = mei_hbuf_max_len(dev); mei_hdr.length = mei_hbuf_max_len(dev);
mei_hdr.msg_complete = 0; mei_hdr.msg_complete = 0;
} else { } else {
mei_hdr.length = buf->size; mei_hdr.length = size;
mei_hdr.msg_complete = 1; mei_hdr.msg_complete = 1;
} }
...@@ -1430,6 +1431,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) ...@@ -1430,6 +1431,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
else else
list_add_tail(&cb->list, &dev->write_list.list); list_add_tail(&cb->list, &dev->write_list.list);
cb = NULL;
if (blocking && cl->writing_state != MEI_WRITE_COMPLETE) { if (blocking && cl->writing_state != MEI_WRITE_COMPLETE) {
mutex_unlock(&dev->device_lock); mutex_unlock(&dev->device_lock);
...@@ -1444,7 +1446,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) ...@@ -1444,7 +1446,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
} }
} }
rets = buf->size; rets = size;
err: err:
cl_dbg(dev, cl, "rpm: autosuspend\n"); cl_dbg(dev, cl, "rpm: autosuspend\n");
pm_runtime_mark_last_busy(dev->dev); pm_runtime_mark_last_busy(dev->dev);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment