Loading drivers/misc/mei/interrupt.c +30 −33 Original line number Diff line number Diff line Loading @@ -299,8 +299,10 @@ static int _mei_irq_thread_close(struct mei_device *dev, s32 *slots, struct mei_cl *cl, struct mei_io_list *cmpl_list) { if ((*slots * sizeof(u32)) >= (sizeof(struct mei_msg_hdr) + sizeof(struct hbm_client_disconnect_request))) { if ((*slots * sizeof(u32)) < (sizeof(struct mei_msg_hdr) + sizeof(struct hbm_client_disconnect_request))) return -EBADMSG; *slots -= mei_data2slots(sizeof(struct hbm_client_disconnect_request)); if (mei_disconnect(dev, cl)) { Loading @@ -317,10 +319,6 @@ static int _mei_irq_thread_close(struct mei_device *dev, s32 *slots, &dev->ctrl_rd_list.mei_cb.cb_list); cl->timer_count = MEI_CONNECT_TIMEOUT; } } else { /* return the cancel routine */ return -EBADMSG; } return 0; } Loading Loading @@ -869,8 +867,13 @@ static int _mei_irq_thread_ioctl(struct mei_device *dev, s32 *slots, struct mei_cl *cl, struct mei_io_list *cmpl_list) { if ((*slots * sizeof(u32)) >= (sizeof(struct mei_msg_hdr) + if ((*slots * sizeof(u32)) < (sizeof(struct mei_msg_hdr) + sizeof(struct hbm_client_connect_request))) { /* return the cancel routine */ list_del(&cb_pos->cb_list); return -EBADMSG; } cl->state = MEI_FILE_CONNECTING; *slots -= mei_data2slots(sizeof(struct hbm_client_connect_request)); if (mei_connect(dev, cl)) { Loading @@ -883,12 +886,6 @@ static int _mei_irq_thread_ioctl(struct mei_device *dev, s32 *slots, &dev->ctrl_rd_list.mei_cb.cb_list); cl->timer_count = MEI_CONNECT_TIMEOUT; } } else { /* return the cancel routine */ list_del(&cb_pos->cb_list); return -EBADMSG; } return 0; } Loading Loading
drivers/misc/mei/interrupt.c +30 −33 Original line number Diff line number Diff line Loading @@ -299,8 +299,10 @@ static int _mei_irq_thread_close(struct mei_device *dev, s32 *slots, struct mei_cl *cl, struct mei_io_list *cmpl_list) { if ((*slots * sizeof(u32)) >= (sizeof(struct mei_msg_hdr) + sizeof(struct hbm_client_disconnect_request))) { if ((*slots * sizeof(u32)) < (sizeof(struct mei_msg_hdr) + sizeof(struct hbm_client_disconnect_request))) return -EBADMSG; *slots -= mei_data2slots(sizeof(struct hbm_client_disconnect_request)); if (mei_disconnect(dev, cl)) { Loading @@ -317,10 +319,6 @@ static int _mei_irq_thread_close(struct mei_device *dev, s32 *slots, &dev->ctrl_rd_list.mei_cb.cb_list); cl->timer_count = MEI_CONNECT_TIMEOUT; } } else { /* return the cancel routine */ return -EBADMSG; } return 0; } Loading Loading @@ -869,8 +867,13 @@ static int _mei_irq_thread_ioctl(struct mei_device *dev, s32 *slots, struct mei_cl *cl, struct mei_io_list *cmpl_list) { if ((*slots * sizeof(u32)) >= (sizeof(struct mei_msg_hdr) + if ((*slots * sizeof(u32)) < (sizeof(struct mei_msg_hdr) + sizeof(struct hbm_client_connect_request))) { /* return the cancel routine */ list_del(&cb_pos->cb_list); return -EBADMSG; } cl->state = MEI_FILE_CONNECTING; *slots -= mei_data2slots(sizeof(struct hbm_client_connect_request)); if (mei_connect(dev, cl)) { Loading @@ -883,12 +886,6 @@ static int _mei_irq_thread_ioctl(struct mei_device *dev, s32 *slots, &dev->ctrl_rd_list.mei_cb.cb_list); cl->timer_count = MEI_CONNECT_TIMEOUT; } } else { /* return the cancel routine */ list_del(&cb_pos->cb_list); return -EBADMSG; } return 0; } Loading