| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 10 Feb 2015 10:39:42 +0200
From: Tomas Winkler <tomas.winkler@...el.com>
To: gregkh@...uxfoundation.org
Cc: arnd@...db.de, linux-kernel@...r.kernel.org,
Tomas Winkler <tomas.winkler@...el.com>
Subject: [char-misc-next 13/18] mei: use only one buffer in callback
The callback structure is used exclusively for reading or writing
therefore there is no reason to hold both response and request buffers
in the callback structure
Signed-off-by: Tomas Winkler <tomas.winkler@...el.com>
---
drivers/misc/mei/amthif.c | 8 ++++----
drivers/misc/mei/bus.c | 6 +++---
drivers/misc/mei/client.c | 47 ++++++++++----------------------------------
drivers/misc/mei/client.h | 3 +--
drivers/misc/mei/interrupt.c | 16 +++++++--------
drivers/misc/mei/main.c | 8 ++++----
drivers/misc/mei/mei_dev.h | 6 ++----
7 files changed, 31 insertions(+), 63 deletions(-)
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index 4060e2f40286..2cc41cb3bb38 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -213,15 +213,15 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
* remove message from deletion list
*/
- dev_dbg(dev->dev, "amthif cb->response_buffer size - %d\n",
- cb->response_buffer.size);
+ dev_dbg(dev->dev, "amthif cb->buf size - %d\n",
+ cb->buf.size);
dev_dbg(dev->dev, "amthif cb->buf_idx - %lu\n", cb->buf_idx);
/* length is being truncated to PAGE_SIZE, however,
* the buf_idx may point beyond */
length = min_t(size_t, length, (cb->buf_idx - *offset));
- if (copy_to_user(ubuf, cb->response_buffer.data + *offset, length)) {
+ if (copy_to_user(ubuf, cb->buf.data + *offset, length)) {
dev_dbg(dev->dev, "failed to copy data to userland\n");
rets = -EFAULT;
} else {
@@ -260,7 +260,7 @@ static int mei_amthif_read_start(struct mei_cl *cl, struct file *file)
goto err;
}
- rets = mei_io_cb_alloc_resp_buf(cb, length);
+ rets = mei_io_cb_alloc_buf(cb, length);
if (rets)
goto err;
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 025626f4467d..36b949a0fddb 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -261,11 +261,11 @@ static ssize_t ___mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
goto out;
}
- rets = mei_io_cb_alloc_req_buf(cb, length);
+ rets = mei_io_cb_alloc_buf(cb, length);
if (rets < 0)
goto out;
- memcpy(cb->request_buffer.data, buf, length);
+ memcpy(cb->buf.data, buf, length);
rets = mei_cl_write(cl, cb, blocking);
@@ -328,7 +328,7 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
}
r_length = min_t(size_t, length, cb->buf_idx);
- memcpy(buf, cb->response_buffer.data, r_length);
+ memcpy(buf, cb->buf.data, r_length);
rets = r_length;
free:
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 978f7f95d66d..9eee3d4b2bc0 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -376,8 +376,7 @@ void mei_io_cb_free(struct mei_cl_cb *cb)
if (cb == NULL)
return;
- kfree(cb->request_buffer.data);
- kfree(cb->response_buffer.data);
+ kfree(cb->buf.data);
kfree(cb);
}
@@ -406,7 +405,7 @@ struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, struct file *fp)
}
/**
- * mei_io_cb_alloc_req_buf - allocate request buffer
+ * mei_io_cb_alloc_buf - allocate callback buffer
*
* @cb: io callback structure
* @length: size of the buffer
@@ -415,7 +414,7 @@ struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, struct file *fp)
* -EINVAL if cb is NULL
* -ENOMEM if allocation failed
*/
-int mei_io_cb_alloc_req_buf(struct mei_cl_cb *cb, size_t length)
+int mei_io_cb_alloc_buf(struct mei_cl_cb *cb, size_t length)
{
if (!cb)
return -EINVAL;
@@ -423,38 +422,12 @@ int mei_io_cb_alloc_req_buf(struct mei_cl_cb *cb, size_t length)
if (length == 0)
return 0;
- cb->request_buffer.data = kmalloc(length, GFP_KERNEL);
- if (!cb->request_buffer.data)
+ cb->buf.data = kmalloc(length, GFP_KERNEL);
+ if (!cb->buf.data)
return -ENOMEM;
- cb->request_buffer.size = length;
+ cb->buf.size = length;
return 0;
}
-/**
- * mei_io_cb_alloc_resp_buf - allocate response buffer
- *
- * @cb: io callback structure
- * @length: size of the buffer
- *
- * Return: 0 on success
- * -EINVAL if cb is NULL
- * -ENOMEM if allocation failed
- */
-int mei_io_cb_alloc_resp_buf(struct mei_cl_cb *cb, size_t length)
-{
- if (!cb)
- return -EINVAL;
-
- if (length == 0)
- return 0;
-
- cb->response_buffer.data = kmalloc(length, GFP_KERNEL);
- if (!cb->response_buffer.data)
- return -ENOMEM;
- cb->response_buffer.size = length;
- return 0;
-}
-
-
/**
* mei_cl_flush_queues - flushes queue lists belonging to cl.
@@ -1005,7 +978,7 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
goto out;
}
- rets = mei_io_cb_alloc_resp_buf(cb, length);
+ rets = mei_io_cb_alloc_buf(cb, length);
if (rets)
goto out;
@@ -1059,7 +1032,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
dev = cl->dev;
- buf = &cb->request_buffer;
+ buf = &cb->buf;
rets = mei_cl_flow_ctrl_creds(cl);
if (rets < 0)
@@ -1094,7 +1067,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
}
cl_dbg(dev, cl, "buf: size = %d idx = %lu\n",
- cb->request_buffer.size, cb->buf_idx);
+ cb->buf.size, cb->buf_idx);
rets = mei_write_message(dev, &mei_hdr, buf->data + cb->buf_idx);
if (rets) {
@@ -1144,7 +1117,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
dev = cl->dev;
- buf = &cb->request_buffer;
+ buf = &cb->buf;
cl_dbg(dev, cl, "size=%d\n", buf->size);
diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index 21cf626e8908..d430a6e09ae8 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -49,8 +49,7 @@ void mei_me_cl_rm_all(struct mei_device *dev);
*/
struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, struct file *fp);
void mei_io_cb_free(struct mei_cl_cb *priv_cb);
-int mei_io_cb_alloc_req_buf(struct mei_cl_cb *cb, size_t length);
-int mei_io_cb_alloc_resp_buf(struct mei_cl_cb *cb, size_t length);
+int mei_io_cb_alloc_buf(struct mei_cl_cb *cb, size_t length);
/**
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 466c1d22fb16..60469a0053bb 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -134,19 +134,17 @@ int mei_cl_irq_read_msg(struct mei_cl *cl,
cl->reading_state = MEI_READING;
- if (cb->response_buffer.size == 0 ||
- cb->response_buffer.data == NULL) {
+ if (cb->buf.size == 0 || cb->buf.data == NULL) {
cl_err(dev, cl, "response buffer is not allocated.\n");
list_move_tail(&cb->list, &complete_list->list);
cb->status = -ENOMEM;
goto out;
}
- if (cb->response_buffer.size < mei_hdr->length + cb->buf_idx) {
+ if (cb->buf.size < mei_hdr->length + cb->buf_idx) {
cl_dbg(dev, cl, "message overflow. size %d len %d idx %ld\n",
- cb->response_buffer.size, mei_hdr->length, cb->buf_idx);
- buffer = krealloc(cb->response_buffer.data,
- mei_hdr->length + cb->buf_idx,
+ cb->buf.size, mei_hdr->length, cb->buf_idx);
+ buffer = krealloc(cb->buf.data, mei_hdr->length + cb->buf_idx,
GFP_KERNEL);
if (!buffer) {
@@ -154,11 +152,11 @@ int mei_cl_irq_read_msg(struct mei_cl *cl,
list_move_tail(&cb->list, &complete_list->list);
goto out;
}
- cb->response_buffer.data = buffer;
- cb->response_buffer.size = mei_hdr->length + cb->buf_idx;
+ cb->buf.data = buffer;
+ cb->buf.size = mei_hdr->length + cb->buf_idx;
}
- buffer = cb->response_buffer.data + cb->buf_idx;
+ buffer = cb->buf.data + cb->buf_idx;
mei_read_slots(dev, buffer, mei_hdr->length);
cb->buf_idx += mei_hdr->length;
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 9d1a8cba81c9..1d44d110ed94 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -264,7 +264,7 @@ copy_buffer:
}
dev_dbg(dev->dev, "buf.size = %d buf.idx= %ld\n",
- cb->response_buffer.size, cb->buf_idx);
+ cb->buf.size, cb->buf_idx);
if (length == 0 || ubuf == NULL || *offset > cb->buf_idx) {
rets = -EMSGSIZE;
goto free;
@@ -274,7 +274,7 @@ copy_buffer:
* however buf_idx may point beyond that */
length = min_t(size_t, length, cb->buf_idx - *offset);
- if (copy_to_user(ubuf, cb->response_buffer.data + *offset, length)) {
+ if (copy_to_user(ubuf, cb->buf.data + *offset, length)) {
dev_dbg(dev->dev, "failed to copy data to userland\n");
rets = -EFAULT;
goto free;
@@ -389,11 +389,11 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
rets = -ENOMEM;
goto out;
}
- rets = mei_io_cb_alloc_req_buf(write_cb, length);
+ rets = mei_io_cb_alloc_buf(write_cb, length);
if (rets)
goto out;
- rets = copy_from_user(write_cb->request_buffer.data, ubuf, length);
+ rets = copy_from_user(write_cb->buf.data, ubuf, length);
if (rets) {
dev_dbg(dev->dev, "failed to copy data from userland\n");
rets = -EFAULT;
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 57a47d6b63ee..1a0f6e9588b6 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -194,8 +194,7 @@ struct mei_cl;
* @list: link in callback queue
* @cl: file client who is running this operation
* @fop_type: file operation type
- * @request_buffer: buffer to store request data
- * @response_buffer: buffer to store response data
+ * @buf: buffer for data associated with the callback
* @buf_idx: last read index
* @read_time: last read operation time stamp (iamthif)
* @file_object: pointer to file structure
@@ -207,8 +206,7 @@ struct mei_cl_cb {
struct list_head list;
struct mei_cl *cl;
enum mei_cb_file_ops fop_type;
- struct mei_msg_data request_buffer;
- struct mei_msg_data response_buffer;
+ struct mei_msg_data buf;
unsigned long buf_idx;
unsigned long read_time;
struct file *file_object;
--
1.9.3
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists