Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84b3294a authored by Tomas Winkler's avatar Tomas Winkler Committed by Greg Kroah-Hartman
Browse files

mei: fix memory leak of mei_clients array 



we never freed the mei_clients array on driver shutdown
only on reset
add mei_hbm_reset function that wraps the hbm cleanup

Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ddb09754

drivers/misc/mei/hbm.c

+29 −17
Original line number Original line Diff line number Diff line
@@ -59,6 +59,34 @@ static int mei_cl_conn_status_to_errno(enum mei_cl_connect_status status) 
	}

	}

}

}





/**

 * mei_hbm_idle - set hbm to idle state

 *

 * @dev: the device structure

 */

void mei_hbm_idle(struct mei_device *dev)

{

	dev->init_clients_timer = 0;

	dev->hbm_state = MEI_HBM_IDLE;

}



/**

 * mei_hbm_reset - reset hbm counters and book keeping data structurs

 *

 * @dev: the device structure

 */

void mei_hbm_reset(struct mei_device *dev)

{

	dev->me_clients_num = 0;

	dev->me_client_presentation_num = 0;

	dev->me_client_index = 0;



	kfree(dev->me_clients);

	dev->me_clients = NULL;



	mei_hbm_idle(dev);

}



/**

/**

 * mei_hbm_me_cl_allocate - allocates storage for me clients

 * mei_hbm_me_cl_allocate - allocates storage for me clients

 *

 *
@@ -71,9 +99,7 @@ static int mei_hbm_me_cl_allocate(struct mei_device *dev) 
	struct mei_me_client *clients;

	struct mei_me_client *clients;

	int b;

	int b;





	dev->me_clients_num = 0;

	mei_hbm_reset(dev);

	dev->me_client_presentation_num = 0;

	dev->me_client_index = 0;





	/* count how many ME clients we have */

	/* count how many ME clients we have */

	for_each_set_bit(b, dev->me_clients_map, MEI_CLIENTS_MAX)

	for_each_set_bit(b, dev->me_clients_map, MEI_CLIENTS_MAX)
@@ -82,9 +108,6 @@ static int mei_hbm_me_cl_allocate(struct mei_device *dev) 
	if (dev->me_clients_num == 0)

	if (dev->me_clients_num == 0)

		return 0;

		return 0;





	kfree(dev->me_clients);

	dev->me_clients = NULL;



	dev_dbg(&dev->pdev->dev, "memory allocation for ME clients size=%ld.\n",

	dev_dbg(&dev->pdev->dev, "memory allocation for ME clients size=%ld.\n",

		dev->me_clients_num * sizeof(struct mei_me_client));

		dev->me_clients_num * sizeof(struct mei_me_client));

	/* allocate storage for ME clients representation */

	/* allocate storage for ME clients representation */
@@ -135,17 +158,6 @@ bool mei_hbm_cl_addr_equal(struct mei_cl *cl, void *buf) 
}

}









/**

 * mei_hbm_idle - set hbm to idle state

 *

 * @dev: the device structure

 */

void mei_hbm_idle(struct mei_device *dev)

{

	dev->init_clients_timer = 0;

	dev->hbm_state = MEI_HBM_IDLE;

}



int mei_hbm_start_wait(struct mei_device *dev)

int mei_hbm_start_wait(struct mei_device *dev)

{

{

	int ret;

	int ret;

drivers/misc/mei/hbm.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -50,6 +50,7 @@ static inline void mei_hbm_hdr(struct mei_msg_hdr *hdr, size_t length) 
}

}





void mei_hbm_idle(struct mei_device *dev);

void mei_hbm_idle(struct mei_device *dev);

void mei_hbm_reset(struct mei_device *dev);

int mei_hbm_start_req(struct mei_device *dev);

int mei_hbm_start_req(struct mei_device *dev);

int mei_hbm_start_wait(struct mei_device *dev);

int mei_hbm_start_wait(struct mei_device *dev);

int mei_hbm_cl_flow_control_req(struct mei_device *dev, struct mei_cl *cl);

int mei_hbm_cl_flow_control_req(struct mei_device *dev, struct mei_cl *cl);

drivers/misc/mei/init.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -122,8 +122,8 @@ int mei_reset(struct mei_device *dev) 
		mei_amthif_reset_params(dev);

		mei_amthif_reset_params(dev);

	}

	}





	mei_hbm_reset(dev);





	dev->me_clients_num = 0;

	dev->rd_msg_hdr = 0;

	dev->rd_msg_hdr = 0;

	dev->wd_pending = false;

	dev->wd_pending = false;