5 files changed, 47 insertions, 34 deletions

diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index c86d7e3839a4..9a5e8c72628b 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -449,7 +449,7 @@ int mei_amthif_irq_write_complete(struct mei_device *dev, s32 *slots,
         struct mei_msg_hdr mei_hdr;
         struct mei_cl *cl = cb->cl;
         size_t len = dev->iamthif_msg_buf_size - dev->iamthif_msg_buf_index;
-        size_t msg_slots = mei_data2slots(len);
+        u32 msg_slots = mei_data2slots(len);
 
         mei_hdr.host_addr = cl->host_client_id;
         mei_hdr.me_addr = cl->me_client_id;
@@ -566,12 +566,13 @@ int mei_amthif_irq_read_message(struct mei_cl_cb *complete_list,
  */
 int mei_amthif_irq_read(struct mei_device *dev, s32 *slots)
 {
+        u32 msg_slots = mei_data2slots(sizeof(struct hbm_flow_control));
 
-        if (((*slots) * sizeof(u32)) < (sizeof(struct mei_msg_hdr)
-                        + sizeof(struct hbm_flow_control))) {
+        if (*slots < msg_slots)
                 return -EMSGSIZE;
-        }
-        *slots -= mei_data2slots(sizeof(struct hbm_flow_control));
+
+        *slots -= msg_slots;
+
         if (mei_hbm_cl_flow_control_req(dev, &dev->iamthif_cl)) {
                 dev_dbg(&dev->pdev->dev, "iamthif flow control failed\n");
                 return -EIO;
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index 45ea7185c003..d21e5a761f2c 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -295,10 +295,11 @@ static int mei_me_write_message(struct mei_device *dev,
                         unsigned char *buf)
 {
         struct mei_me_hw *hw = to_me_hw(dev);
-        unsigned long rem, dw_cnt;
+        unsigned long rem;
         unsigned long length = header->length;
         u32 *reg_buf = (u32 *)buf;
         u32 hcsr;
+        u32 dw_cnt;
         int i;
         int empty_slots;
 
diff --git a/drivers/misc/mei/hw-me.h b/drivers/misc/mei/hw-me.h
index 8518d3eeb838..80bd829fbd9a 100644
--- a/drivers/misc/mei/hw-me.h
+++ b/drivers/misc/mei/hw-me.h
@@ -36,12 +36,6 @@ struct mei_me_hw {
 
 struct mei_device *mei_me_dev_init(struct pci_dev *pdev);
 
-/* get slots (dwords) from a message length + header (bytes) */
-static inline unsigned char mei_data2slots(size_t length)
-{
-        return DIV_ROUND_UP(sizeof(struct mei_msg_hdr) + length, 4);
-}
-
 irqreturn_t mei_me_irq_quick_handler(int irq, void *dev_id);
 irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id);
 
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 3535b2676c97..14c70b8815d8 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -153,25 +153,27 @@ static int _mei_irq_thread_close(struct mei_device *dev, s32 *slots,
                                 struct mei_cl *cl,
                                 struct mei_cl_cb *cmpl_list)
 {
-        if ((*slots * sizeof(u32)) < (sizeof(struct mei_msg_hdr) +
-                        sizeof(struct hbm_client_connect_request)))
-                return -EBADMSG;
+        u32 msg_slots =
+                mei_data2slots(sizeof(struct hbm_client_connect_request));
 
-        *slots -= mei_data2slots(sizeof(struct hbm_client_connect_request));
+        if (*slots < msg_slots)
+                return -EMSGSIZE;
+
+        *slots -= msg_slots;
 
         if (mei_hbm_cl_disconnect_req(dev, cl)) {
                 cl->status = 0;
                 cb_pos->buf_idx = 0;
                 list_move_tail(&cb_pos->list, &cmpl_list->list);
-                return -EMSGSIZE;
-        } else {
-                cl->state = MEI_FILE_DISCONNECTING;
-                cl->status = 0;
-                cb_pos->buf_idx = 0;
-                list_move_tail(&cb_pos->list, &dev->ctrl_rd_list.list);
-                cl->timer_count = MEI_CONNECT_TIMEOUT;
+                return -EIO;
         }
 
+        cl->state = MEI_FILE_DISCONNECTING;
+        cl->status = 0;
+        cb_pos->buf_idx = 0;
+        list_move_tail(&cb_pos->list, &dev->ctrl_rd_list.list);
+        cl->timer_count = MEI_CONNECT_TIMEOUT;
+
         return 0;
 }
 
@@ -192,14 +194,15 @@ static int _mei_irq_thread_read(struct mei_device *dev,	s32 *slots,
                         struct mei_cl *cl,
                         struct mei_cl_cb *cmpl_list)
 {
-        if ((*slots * sizeof(u32)) < (sizeof(struct mei_msg_hdr) +
-                        sizeof(struct hbm_flow_control))) {
+        u32 msg_slots = mei_data2slots(sizeof(struct hbm_flow_control));
+
+        if (*slots < msg_slots) {
                 /* return the cancel routine */
                 list_del(&cb_pos->list);
-                return -EBADMSG;
+                return -EMSGSIZE;
         }
 
-        *slots -= mei_data2slots(sizeof(struct hbm_flow_control));
+        *slots -= msg_slots;
 
         if (mei_hbm_cl_flow_control_req(dev, cl)) {
                 cl->status = -ENODEV;
@@ -229,15 +232,19 @@ static int _mei_irq_thread_ioctl(struct mei_device *dev, s32 *slots,
                         struct mei_cl *cl,
                         struct mei_cl_cb *cmpl_list)
 {
-        if ((*slots * sizeof(u32)) < (sizeof(struct mei_msg_hdr) +
-                        sizeof(struct hbm_client_connect_request))) {
+        u32 msg_slots =
+                mei_data2slots(sizeof(struct hbm_client_connect_request));
+
+        if (*slots < msg_slots) {
                 /* return the cancel routine */
                 list_del(&cb_pos->list);
-                return -EBADMSG;
+                return -EMSGSIZE;
         }
 
+        *slots -=  msg_slots;
+
         cl->state = MEI_FILE_CONNECTING;
-        *slots -= mei_data2slots(sizeof(struct hbm_client_connect_request));
+
         if (mei_hbm_cl_connect_req(dev, cl)) {
                 cl->status = -ENODEV;
                 cb_pos->buf_idx = 0;
@@ -266,7 +273,7 @@ static int mei_irq_thread_write_complete(struct mei_device *dev, s32 *slots,
         struct mei_msg_hdr mei_hdr;
         struct mei_cl *cl = cb->cl;
         size_t len = cb->request_buffer.size - cb->buf_idx;
-        size_t msg_slots = mei_data2slots(len);
+        u32 msg_slots = mei_data2slots(len);
 
         mei_hdr.host_addr = cl->host_client_id;
         mei_hdr.me_addr = cl->me_client_id;
@@ -419,8 +426,7 @@ end:
  *
  * returns 0 on success, <0 on failure.
  */
-int mei_irq_write_handler(struct mei_device *dev,
-                                struct mei_cl_cb *cmpl_list)
+int mei_irq_write_handler(struct mei_device *dev, struct mei_cl_cb *cmpl_list)
 {
 
         struct mei_cl *cl;
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index cb80166161f0..09a2af4294a6 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -374,6 +374,17 @@ static inline unsigned long mei_secs_to_jiffies(unsigned long sec)
         return msecs_to_jiffies(sec * MSEC_PER_SEC);
 }
 
+/**
+ * mei_data2slots - get slots - number of (dwords) from a message length
+ *      + size of the mei header
+ * @length - size of the messages in bytes
+ * returns  - number of slots
+ */
+static inline u32 mei_data2slots(size_t length)
+{
+        return DIV_ROUND_UP(sizeof(struct mei_msg_hdr) + length, 4);
+}
+
 
 /*
  * mei init function prototypes