1 files changed, 15 insertions, 18 deletions

diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index e8b0858132c1..3d4f6d17d74c 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -415,16 +415,15 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
 		goto out;
 	}
 
-	if (cl->read_cb && cl->read_cb->information > *offset) {
+	if (cl->read_cb && cl->read_cb->buf_idx > *offset) {
 		cb = cl->read_cb;
 		goto copy_buffer;
-	} else if (cl->read_cb && cl->read_cb->information > 0 &&
-		   cl->read_cb->information <= *offset) {
+	} else if (cl->read_cb && cl->read_cb->buf_idx > 0 &&
+		   cl->read_cb->buf_idx <= *offset) {
 		cb = cl->read_cb;
 		rets = 0;
 		goto free;
-	} else if ((!cl->read_cb || !cl->read_cb->information) &&
-		    *offset > 0) {
+	} else if ((!cl->read_cb || !cl->read_cb->buf_idx) && *offset > 0) {
 		/*Offset needs to be cleaned for contiguous reads*/
 		*offset = 0;
 		rets = 0;
@@ -481,16 +480,15 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
 copy_buffer:
 	dev_dbg(&dev->pdev->dev, "cb->response_buffer size - %d\n",
 	    cb->response_buffer.size);
-	dev_dbg(&dev->pdev->dev, "cb->information - %lu\n",
-	    cb->information);
-	if (length == 0 || ubuf == NULL || *offset > cb->information) {
+	dev_dbg(&dev->pdev->dev, "cb->buf_idx - %lu\n", cb->buf_idx);
+	if (length == 0 || ubuf == NULL || *offset > cb->buf_idx) {
 		rets = -EMSGSIZE;
 		goto free;
 	}
 
-	/* length is being truncated to PAGE_SIZE, however, */
-	/* information size may be longer */
-	length = min_t(size_t, length, (cb->information - *offset));
+	/* length is being truncated to PAGE_SIZE,
+	 * however buf_idx may point beyond that */
+	length = min_t(size_t, length, cb->buf_idx - *offset);
 
 	if (copy_to_user(ubuf, cb->response_buffer.data + *offset, length)) {
 		rets = -EFAULT;
@@ -499,7 +497,7 @@ copy_buffer:
 
 	rets = length;
 	*offset += length;
-	if ((unsigned long)*offset < cb->information)
+	if ((unsigned long)*offset < cb->buf_idx)
 		goto out;
 
 free:
@@ -637,7 +635,7 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
 
 		write_cb->response_buffer.size = dev->iamthif_mtu;
 		write_cb->major_file_operations = MEI_IOCTL;
-		write_cb->information = 0;
+		write_cb->buf_idx = 0;
 		write_cb->request_buffer.size = length;
 		if (dev->iamthif_cl.state != MEI_FILE_CONNECTED) {
 			rets = -ENODEV;
@@ -668,9 +666,8 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
 	}
 
 	write_cb->major_file_operations = MEI_WRITE;
-	/* make sure information is zero before we start */
-
-	write_cb->information = 0;
+	/* make sure buffer index is zero before we start */
+	write_cb->buf_idx = 0;
 	write_cb->request_buffer.size = length;
 
 	dev_dbg(&dev->pdev->dev, "host client = %d, ME client = %d\n",
@@ -719,7 +716,7 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
 			goto unlock_dev;
 		}
 		cl->writing_state = MEI_WRITING;
-		write_cb->information = mei_hdr.length;
+		write_cb->buf_idx = mei_hdr.length;
 		if (mei_hdr.msg_complete) {
 			if (mei_flow_ctrl_reduce(dev, cl)) {
 				rets = -ENODEV;
@@ -734,7 +731,7 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
 
 	} else {
 
-		write_cb->information = 0;
+		write_cb->buf_idx = 0;
 		cl->writing_state = MEI_WRITING;
 		list_add_tail(&write_cb->cb_list,
 			      &dev->write_list.mei_cb.cb_list);