Commit 251e9b12 authored by Alexander Usyskin's avatar Alexander Usyskin Committed by Wen Zhiwei
Browse files

mei: use kvmalloc for read buffer 

stable inclusion
from stable-v6.6.60
commit 4882a352b5df897c30f9d64fba340a219a6604d0
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IB44K1

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4882a352b5df897c30f9d64fba340a219a6604d0



--------------------------------

[ Upstream commit 4adf613e01bf99e1739f6ff3e162ad5b7d578d1a ]

Read buffer is allocated according to max message size, reported by
the firmware and may reach 64K in systems with pxp client.
Contiguous 64k allocation may fail under memory pressure.
Read buffer is used as in-driver message storage and not required
to be contiguous.
Use kvmalloc to allow kernel to allocate non-contiguous memory.

Fixes: 3030dc05 ("mei: add wrapper for queuing control commands.")
Cc: stable <stable@kernel.org>
Reported-by: default avatarRohit Agarwal <rohiagar@chromium.org>
Closes: https://lore.kernel.org/all/20240813084542.2921300-1-rohiagar@chromium.org/


Tested-by: default avatarBrian Geffon <bgeffon@google.com>
Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
Acked-by: default avatarTomas Winkler <tomasw@gmail.com>
Link: https://lore.kernel.org/r/20241015123157.2337026-1-alexander.usyskin@intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent 1cfc394d

drivers/misc/mei/client.c

+2 −2
Original line number Diff line number Diff line
@@ -321,7 +321,7 @@ void mei_io_cb_free(struct mei_cl_cb *cb) 
		return;



	list_del(&cb->list);

	kfree(cb->buf.data);

	kvfree(cb->buf.data);

	kfree(cb->ext_hdr);

	kfree(cb);

}
@@ -497,7 +497,7 @@ struct mei_cl_cb *mei_cl_alloc_cb(struct mei_cl *cl, size_t length, 
	if (length == 0)

		return cb;



	cb->buf.data = kmalloc(roundup(length, MEI_SLOT_SIZE), GFP_KERNEL);

	cb->buf.data = kvmalloc(roundup(length, MEI_SLOT_SIZE), GFP_KERNEL);

	if (!cb->buf.data) {

		mei_io_cb_free(cb);

		return NULL;