tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mei: bus: Check for still connected devices in mei_cl_bus_dev_release()

mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl)
belonging to the device being released.

If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers,
the mei-client being freed might still be part of the mei_device's
file_list and iterating over this list after the freeing will then trigger
a use-afer-free bug.

Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed
mei-client is not on the mei_device's file_list.

Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250623085052.12347-11-hansg@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Hans de Goede and committed by
Greg Kroah-Hartman 35e8a426 cee3dba7

+6
+6
drivers/misc/mei/bus.c
··· 1300 1300 static void mei_cl_bus_dev_release(struct device *dev) 1301 1301 { 1302 1302 struct mei_cl_device *cldev = to_mei_cl_device(dev); 1303 + struct mei_device *mdev = cldev->cl->dev; 1304 + struct mei_cl *cl; 1303 1305 1304 1306 mei_cl_flush_queues(cldev->cl, NULL); 1305 1307 mei_me_cl_put(cldev->me_cl); 1306 1308 mei_dev_bus_put(cldev->bus); 1309 + 1310 + list_for_each_entry(cl, &mdev->file_list, link) 1311 + WARN_ON(cl == cldev->cl); 1312 + 1307 1313 kfree(cldev->cl); 1308 1314 kfree(cldev); 1309 1315 }