imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-11-02 23:54:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

mei: bus: Check for still connected devices in mei_cl_bus_dev_release()

Browse Source 
mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl)
belonging to the device being released.

If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers,
the mei-client being freed might still be part of the mei_device's
file_list and iterating over this list after the freeing will then trigger
a use-afer-free bug.

Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed
mei-client is not on the mei_device's file_list.

Signed-off-by: Hans de Goede <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
This commit is contained in:
Hans de Goede authored and Greg Kroah-Hartman committed 2025-06-24 16:39:02 +01:00
1 parent cee3dba7b7
commit 35e8a426b1
1 file changed
+6
Download Patch File Download Diff File Expand all files Collapse all files
drivers/misc/mei/bus.c
+6
View File
@@ -1300,10 +1300,16 @@ static void mei_dev_bus_put(struct mei_device *bus)
static void mei_cl_bus_dev_release(struct device *dev)
{
struct mei_cl_device *cldev = to_mei_cl_device(dev);
struct mei_device *mdev = cldev->cl->dev;
struct mei_cl *cl;
mei_cl_flush_queues(cldev->cl, NULL);
mei_me_cl_put(cldev->me_cl);
mei_dev_bus_put(cldev->bus);
list_for_each_entry(cl, &mdev->file_list, link)
WARN_ON(cl == cldev->cl);
kfree(cldev->cl);
kfree(cldev);
}