linux-toradex.git/drivers/misc/mei, branch v4.4.24

mei: bus: call mei_cl_read_start under device lock

2016-06-01T19:15:50+00:00

commit bc46b45a421a64a0895dd41a34d3d2086e1ac7f6 upstream.

Ensure that mei_cl_read_start is called under the device lock
also in the bus layer. The function updates global ctrl_wr_list
which should be locked.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: amthif: discard not read messages

2016-06-01T19:15:50+00:00

commit 9d04ee11db7bf0d848266cbfd7db336097a0e239 upstream.

When a message is received and amthif client is not in reading state
the message is ignored and left dangling in the queue. This may happen
after one of the amthif host connections is closed w/o completing the
reading. Another client will pick up a wrong message on next read
attempt which will lead to link reset.
To prevent this the driver has to properly discard the message when
amthif client is not in reading state.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: fix NULL dereferencing during FW initiated disconnection

2016-06-01T19:15:50+00:00

commit 6a8d648c8d1824117a9e9edb948ed1611fb013c0 upstream.

In the case when disconnection is initiated from the FW
the driver is flushing items from the write control list while
iterating over it:

mei_irq_write_handler()
    list_for_each_entry_safe(ctrl_wr_list)         <-- outer loop
         mei_cl_irq_disconnect_rsp()
             mei_cl_set_disconnected()
                 mei_io_list_flush(ctrl_wr_list)   <-- destorying list

We move the list flushing to the completion routine.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: bus: check if the device is enabled before data transfer

2016-04-12T16:08:46+00:00

commit 15c13dfcad883a1e76b714480fb27be96247fd82 upstream.

The bus data transfer interface was missing the check if the device is
in enabled state, this may lead to stack corruption during link reset.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: validate request value in client notify request ioctl

2016-03-03T23:07:13+00:00

commit 7326fffb712f09a315bc73cc1ee63843f59b8bd4 upstream.

This patch address a possible security issue:

The request field in client notify request ioctl comes from user space
as u32 and is downcasted to u8 with out validation.
Check request field to have approved values
MEI_HBM_NOTIFICATION_STAR/STOP

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: fix fasync return value on error

2016-03-03T23:07:13+00:00

commit ed6dc538e5a36a331b6256d54f435c80f6715460 upstream.

fasync should return a negative value on error
and not poll mask POLLERR.

Cc: Al Viro 
Reported-by: Al Viro 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'char-misc-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2015-11-05T06:15:15+00:00

Pull char/misc driver updates from Greg KH:
 "Here is the big char/misc driver update for 4.4-rc1.  Lots of
  different driver and subsystem updates, hwtracing being the largest
  with the addition of some new platforms that are now supported.  Full
  details in the shortlog.

  All of these have been in linux-next for a long time with no reported
  issues"

* tag 'char-misc-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (181 commits)
  fpga: socfpga: Fix check of return value of devm_request_irq
  lkdtm: fix ACCESS_USERSPACE test
  mcb: Destroy IDA on module unload
  mcb: Do not return zero on error path in mcb_pci_probe()
  mei: bus: set the device name before running fixup
  mei: bus: use correct lock ordering
  mei: Fix debugfs filename in error output
  char: ipmi: ipmi_ssif: Replace timeval with timespec64
  fpga: zynq-fpga: Fix issue with drvdata being overwritten.
  fpga manager: remove unnecessary null pointer checks
  fpga manager: ensure lifetime with of_fpga_mgr_get
  fpga: zynq-fpga: Change fw format to handle bin instead of bit.
  fpga: zynq-fpga: Fix unbalanced clock handling
  misc: sram: partition base address belongs to __iomem space
  coresight: etm3x: adding documentation for sysFS's cpu interface
  vme: 8-bit status/id takes 256 values, not 255
  fpga manager: Adding FPGA Manager support for Xilinx Zynq 7000
  ARM: zynq: dt: Updated devicetree for Zynq 7000 platform.
  ARM: dt: fpga: Added binding docs for Xilinx Zynq FPGA manager.
  ver_linux: proc/modules, limit text processing to 'sed'
  ...

Merge tag 'driver-core-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

2015-11-05T05:50:37+00:00

Pull driver core updates from Greg KH:
 "Here's the "big" driver core updates for 4.4-rc1.  Primarily a bunch
  of debugfs updates, with a smattering of minor driver core fixes and
  updates as well.

  All have been in linux-next for a long time"

* tag 'driver-core-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  debugfs: Add debugfs_create_ulong()
  of: to support binding numa node to specified device in devicetree
  debugfs: Add read-only/write-only bool file ops
  debugfs: Add read-only/write-only size_t file ops
  debugfs: Add read-only/write-only x64 file ops
  debugfs: Consolidate file mode checks in debugfs_create_*()
  Revert "mm: Check if section present during memory block (un)registering"
  driver-core: platform: Provide helpers for multi-driver modules
  mm: Check if section present during memory block (un)registering
  devres: fix a for loop bounds check
  CMA: fix CONFIG_CMA_SIZE_MBYTES overflow in 64bit
  base/platform: assert that dev_pm_domain callbacks are called unconditionally
  sysfs: correctly handle short reads on PREALLOC attrs.
  base: soc: siplify ida usage
  kobject: move EXPORT_SYMBOL() macros next to corresponding definitions
  kobject: explain what kobject's sd field is
  debugfs: document that debugfs_remove*() accepts NULL and error values
  debugfs: Pass bool pointer to debugfs_create_bool()
  ACPI / EC: Fix broken 64bit big-endian users of 'global_lock'

mei: bus: set the device name before running fixup

2015-10-29T00:02:16+00:00

The mei bus fixup use dev_xxx services for printing
to kernel log so we need to setup the device name
prior to running fixup hooks.

Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: bus: use correct lock ordering

2015-10-29T00:02:16+00:00

The correct lock order is
  cl_bus_lock
    device_lock
      me_clients_rwsem

This order was violated in bus rescan and remove routines
when me_client_rwsem was locked before cl_bus_lock.

Chain exists of:
[    4.321653]   &dev->device_lock --> &dev->me_clients_rwsem -->
&dev->cl_bus_lock
[    4.321653]
[    4.321679]  Possible unsafe locking scenario:
[    4.321679]
[    4.321693]        CPU0                    CPU1
[    4.321701]        ----                    ----
[    4.321709]   lock(&dev->cl_bus_lock);
[    4.321720]
lock(&dev->me_clients_rwsem);
[    4.321733]                                lock(&dev->cl_bus_lock);
[    4.321745]   lock(&dev->device_lock);
[    4.321755]
[    4.321755]  *** DEADLOCK ***
[    4.321755]

Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman