Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 23253c31 authored by Alexander Usyskin's avatar Alexander Usyskin Committed by Greg Kroah-Hartman
Browse files

mei: do not access freed cb in blocking write 



The mei_cl_write function is giving up on a write cb ownership after it
was sent or queued. The write cb is then freed in the completion
handler. Especially during blocking write mei_cl_write function waits
for the completion handler and then access the freed memory to fetch the
written size.  The quick fix is to store the buffer size prior to
sending, the size is not altered during the flow.

Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0bd38ae3

drivers/misc/mei/client.c

+9 −7
Original line number Diff line number Diff line
@@ -1356,6 +1356,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) 
	struct mei_device *dev;

	struct mei_msg_data *buf;

	struct mei_msg_hdr mei_hdr;

	int size;

	int rets;
@@ -1367,10 +1368,10 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) 


	dev = cl->dev;





	buf = &cb->buf;

	size = buf->size;



	cl_dbg(dev, cl, "size=%d\n", buf->size);

	cl_dbg(dev, cl, "size=%d\n", size);



	rets = pm_runtime_get(dev->dev);

	if (rets < 0 && rets != -EINPROGRESS) {
@@ -1394,21 +1395,21 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) 


	if (rets == 0) {

		cl_dbg(dev, cl, "No flow control credentials: not sending.\n");

		rets = buf->size;

		rets = size;

		goto out;

	}

	if (!mei_hbuf_acquire(dev)) {

		cl_dbg(dev, cl, "Cannot acquire the host buffer: not sending.\n");

		rets = buf->size;

		rets = size;

		goto out;

	}



	/* Check for a maximum length */

	if (buf->size > mei_hbuf_max_len(dev)) {

	if (size > mei_hbuf_max_len(dev)) {

		mei_hdr.length = mei_hbuf_max_len(dev);

		mei_hdr.msg_complete = 0;

	} else {

		mei_hdr.length = buf->size;

		mei_hdr.length = size;

		mei_hdr.msg_complete = 1;

	}
@@ -1430,6 +1431,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) 
	else

		list_add_tail(&cb->list, &dev->write_list.list);



	cb = NULL;

	if (blocking && cl->writing_state != MEI_WRITE_COMPLETE) {



		mutex_unlock(&dev->device_lock);
@@ -1444,7 +1446,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) 
		}

	}



	rets = buf->size;

	rets = size;

err:

	cl_dbg(dev, cl, "rpm: autosuspend\n");

	pm_runtime_mark_last_busy(dev->dev);