From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752165AbbGWHoN (ORCPT ); Thu, 23 Jul 2015 03:44:13 -0400 Received: from mga09.intel.com ([134.134.136.24]:58562 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751173AbbGWHoG (ORCPT ); Thu, 23 Jul 2015 03:44:06 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.15,529,1432623600"; d="scan'208";a="768035688" From: Tomas Winkler To: Greg Kroah-Hartman Cc: arnd@arndb.de, Alexander Usyskin , linux-kernel@vger.kernel.org, Tomas Winkler Subject: [char-misc 4.2] mei: do not access freed cb in blocking write Date: Thu, 23 Jul 2015 10:43:11 +0300 Message-Id: <1437637391-9046-1-git-send-email-tomas.winkler@intel.com> X-Mailer: git-send-email 2.4.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alexander Usyskin The mei_cl_write function is giving up on a write cb ownership after it was sent or queued. The write cb is then freed in the completion handler. Especially during blocking write mei_cl_write function waits for the completion handler and then access the freed memory to fetch the written size. The quick fix is to store the buffer size prior to sending, the size is not altered during the flow. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler --- drivers/misc/mei/client.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c index 6decbe136ea7..1987a201c7f3 100644 --- a/drivers/misc/mei/client.c +++ b/drivers/misc/mei/client.c @@ -1356,6 +1356,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) struct mei_device *dev; struct mei_msg_data *buf; struct mei_msg_hdr mei_hdr; + int size; int rets; @@ -1367,10 +1368,10 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) dev = cl->dev; - buf = &cb->buf; + size = buf->size; - cl_dbg(dev, cl, "size=%d\n", buf->size); + cl_dbg(dev, cl, "size=%d\n", size); rets = pm_runtime_get(dev->dev); if (rets < 0 && rets != -EINPROGRESS) { @@ -1394,21 +1395,21 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) if (rets == 0) { cl_dbg(dev, cl, "No flow control credentials: not sending.\n"); - rets = buf->size; + rets = size; goto out; } if (!mei_hbuf_acquire(dev)) { cl_dbg(dev, cl, "Cannot acquire the host buffer: not sending.\n"); - rets = buf->size; + rets = size; goto out; } /* Check for a maximum length */ - if (buf->size > mei_hbuf_max_len(dev)) { + if (size > mei_hbuf_max_len(dev)) { mei_hdr.length = mei_hbuf_max_len(dev); mei_hdr.msg_complete = 0; } else { - mei_hdr.length = buf->size; + mei_hdr.length = size; mei_hdr.msg_complete = 1; } @@ -1430,6 +1431,7 @@ out: else list_add_tail(&cb->list, &dev->write_list.list); + cb = NULL; if (blocking && cl->writing_state != MEI_WRITE_COMPLETE) { mutex_unlock(&dev->device_lock); @@ -1444,7 +1446,7 @@ out: } } - rets = buf->size; + rets = size; err: cl_dbg(dev, cl, "rpm: autosuspend\n"); pm_runtime_mark_last_busy(dev->dev); -- 2.4.3