]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
authorHans de Goede <hansg@kernel.org>
Mon, 23 Jun 2025 08:50:52 +0000 (10:50 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 28 Aug 2025 14:25:54 +0000 (16:25 +0200)
commit6f2a6ef86b23a30b92ad57981de537bce67bfa45
treed5f2deb06977ae912464d6e96d2fc311802d06a3
parentdd9d5b4dfd0f9b719e1cf5c14c50e4298f3a31f3
mei: bus: Check for still connected devices in mei_cl_bus_dev_release()

[ Upstream commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 ]

mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl)
belonging to the device being released.

If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers,
the mei-client being freed might still be part of the mei_device's
file_list and iterating over this list after the freeing will then trigger
a use-afer-free bug.

Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed
mei-client is not on the mei_device's file_list.

Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250623085052.12347-11-hansg@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/misc/mei/bus.c