From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BCBDC433EF for ; Fri, 31 Dec 2021 09:40:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229626AbhLaJkL (ORCPT ); Fri, 31 Dec 2021 04:40:11 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:53076 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229555AbhLaJkK (ORCPT ); Fri, 31 Dec 2021 04:40:10 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D0F7F617A8 for ; Fri, 31 Dec 2021 09:40:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5539DC36AEB; Fri, 31 Dec 2021 09:40:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640943609; bh=918PJt+iFOH9YmoTcbmB75fI77L/ng6/DY6d6GEB5+c=; h=Subject:To:From:Date:From; b=WlVREQ1aK2F70nDFZVRyWuClYkDpIUB9K+doxwE7UQ7+7AqHJkH+eNd+iW4xZJXGS Xv2pHp+bHxn8vsXI2EwJFdaQpaedrONcbuA5Gne8gBpd4E8wErhNNanaZGmL5kKUPr 5d341bIdGYsrd02MgNxYpnyYowoB/ji/52uLVb2M= Subject: patch "mei: hbm: fix client dma reply status" added to char-misc-next To: alexander.usyskin@intel.com, emmanuel.grumbach@intel.com, gregkh@linuxfoundation.org, stable@vger.kernel.org, tomas.winkler@intel.com From: Date: Fri, 31 Dec 2021 10:39:43 +0100 Message-ID: <1640943583172197@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org This is a note to let you know that I've just added the patch titled mei: hbm: fix client dma reply status to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 6b0b80ac103b2a40c72a47c301745fd1f4ef4697 Mon Sep 17 00:00:00 2001 From: Alexander Usyskin Date: Tue, 28 Dec 2021 10:20:47 +0200 Subject: mei: hbm: fix client dma reply status Don't blindly copy status value received from the firmware into internal client status field, It may be positive and ERR_PTR(ret) will translate it into an invalid address and the caller will crash. Put the error code into the client status on failure. Fixes: 369aea845951 ("mei: implement client dma setup.") Cc: # v5.11+ Reported-by: Emmanuel Grumbach Tested-by: : Emmanuel Grumbach Acked-by: Tomas Winkler Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20211228082047.378115-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman --- drivers/misc/mei/hbm.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c index be41843df75b..cebcca6d6d3e 100644 --- a/drivers/misc/mei/hbm.c +++ b/drivers/misc/mei/hbm.c @@ -672,10 +672,14 @@ static void mei_hbm_cl_dma_map_res(struct mei_device *dev, if (!cl) return; - dev_dbg(dev->dev, "cl dma map result = %d\n", res->status); - cl->status = res->status; - if (!cl->status) + if (res->status) { + dev_err(dev->dev, "cl dma map failed %d\n", res->status); + cl->status = -EFAULT; + } else { + dev_dbg(dev->dev, "cl dma map succeeded\n"); cl->dma_mapped = 1; + cl->status = 0; + } wake_up(&cl->wait); } @@ -698,10 +702,14 @@ static void mei_hbm_cl_dma_unmap_res(struct mei_device *dev, if (!cl) return; - dev_dbg(dev->dev, "cl dma unmap result = %d\n", res->status); - cl->status = res->status; - if (!cl->status) + if (res->status) { + dev_err(dev->dev, "cl dma unmap failed %d\n", res->status); + cl->status = -EFAULT; + } else { + dev_dbg(dev->dev, "cl dma unmap succeeded\n"); cl->dma_mapped = 0; + cl->status = 0; + } wake_up(&cl->wait); } -- 2.34.1