mei: fix reading large reposnes

While writting to device is limitted to max_msg_length advertized
in client properites the read can be much longer delivered consequiting chunks.

We use krealloc to enlarge the buffer when needed.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

5 files changed, 27 insertions, 15 deletions

diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 834ceeb69cbf..1e935eacaa7f 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -286,7 +286,7 @@ int __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
         mutex_lock(&dev->device_lock);
 
         if (!cl->read_cb) {
-                err = mei_cl_read_start(cl);
+                err = mei_cl_read_start(cl, length);
                 if (err < 0) {
                         mutex_unlock(&dev->device_lock);
                         return err;
@@ -378,7 +378,7 @@ static void mei_bus_event_work(struct work_struct *work)
         device->events = 0;
 
         /* Prepare for the next read */
-        mei_cl_read_start(device->cl);
+        mei_cl_read_start(device->cl, 0);
 }
 
 int mei_cl_register_event_cb(struct mei_cl_device *device,
@@ -392,7 +392,7 @@ int mei_cl_register_event_cb(struct mei_cl_device *device,
         device->event_context = context;
         INIT_WORK(&device->event_work, mei_bus_event_work);
 
-        mei_cl_read_start(device->cl);
+        mei_cl_read_start(device->cl, 0);
 
         return 0;
 }
@@ -436,7 +436,7 @@ int mei_cl_enable_device(struct mei_cl_device *device)
         mutex_unlock(&dev->device_lock);
 
         if (device->event_cb && !cl->read_cb)
-                mei_cl_read_start(device->cl);
+                mei_cl_read_start(device->cl, 0);
 
         if (!device->ops || !device->ops->enable)
                 return 0;
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 9541aa90d8f7..71892745e2e8 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -624,7 +624,7 @@ int mei_cl_flow_ctrl_reduce(struct mei_cl *cl)
  *
  * returns 0 on success, <0 on failure.
  */
-int mei_cl_read_start(struct mei_cl *cl)
+int mei_cl_read_start(struct mei_cl *cl, size_t length)
 {
         struct mei_device *dev;
         struct mei_cl_cb *cb;
@@ -657,8 +657,9 @@ int mei_cl_read_start(struct mei_cl *cl)
         if (!cb)
                 return -ENOMEM;
 
-        rets = mei_io_cb_alloc_resp_buf(cb,
-                        dev->me_clients[i].props.max_msg_length);
+        /* always allocate at least client max message */
+        length = max_t(size_t, length, dev->me_clients[i].props.max_msg_length);
+        rets = mei_io_cb_alloc_resp_buf(cb, length);
         if (rets)
                 goto err;
 
diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index e890c8bf89d0..cfdb144526aa 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -87,7 +87,7 @@ int mei_cl_flow_ctrl_reduce(struct mei_cl *cl);
 bool mei_cl_is_other_connecting(struct mei_cl *cl);
 int mei_cl_disconnect(struct mei_cl *cl);
 int mei_cl_connect(struct mei_cl *cl, struct file *file);
-int mei_cl_read_start(struct mei_cl *cl);
+int mei_cl_read_start(struct mei_cl *cl, size_t length);
 int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking);
 
 void mei_host_client_init(struct work_struct *work);
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 9bf64c06fa39..74730713a8d3 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -145,9 +145,21 @@ static int mei_cl_irq_read_msg(struct mei_device *dev,
                 }
 
                 if (cb->response_buffer.size < mei_hdr->length + cb->buf_idx) {
-                        dev_warn(&dev->pdev->dev, "message overflow.\n");
-                        list_del(&cb->list);
-                        return -ENOMEM;
+                        dev_dbg(&dev->pdev->dev, "message overflow. size %d len %d idx %ld\n",
+                                cb->response_buffer.size,
+                                mei_hdr->length, cb->buf_idx);
+                        cb->response_buffer.data =
+                                        krealloc(cb->response_buffer.data,
+                                        mei_hdr->length + cb->buf_idx,
+                                        GFP_KERNEL);
+
+                        if (!cb->response_buffer.data) {
+                                dev_err(&dev->pdev->dev, "allocation failed.\n");
+                                list_del(&cb->list);
+                                return -ENOMEM;
+                        }
+                        cb->response_buffer.size =
+                                mei_hdr->length + cb->buf_idx;
                 }
 
                 buffer = cb->response_buffer.data + cb->buf_idx;
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 78b4da5ed96c..7c44c8dbae42 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -244,7 +244,7 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                 goto out;
         }
 
-        err = mei_cl_read_start(cl);
+        err = mei_cl_read_start(cl, length);
         if (err && err != -EBUSY) {
                 dev_dbg(&dev->pdev->dev,
                         "mei start read failure with status = %d\n", err);
@@ -292,9 +292,8 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
         }
         /* now copy the data to user space */
 copy_buffer:
-        dev_dbg(&dev->pdev->dev, "cb->response_buffer size - %d\n",
-            cb->response_buffer.size);
-        dev_dbg(&dev->pdev->dev, "cb->buf_idx - %lu\n", cb->buf_idx);
+        dev_dbg(&dev->pdev->dev, "buf.size = %d buf.idx= %ld\n",
+            cb->response_buffer.size, cb->buf_idx);
         if (length == 0 || ubuf == NULL || *offset > cb->buf_idx) {
                 rets = -EMSGSIZE;
                 goto free;