]> git.ipfire.org Git - thirdparty/linux.git/commit
mei: bus: access mei_device under device_lock on cleanup
authorAlexander Usyskin <alexander.usyskin@intel.com>
Sun, 5 Jul 2026 15:12:59 +0000 (18:12 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 Jul 2026 12:51:44 +0000 (14:51 +0200)
commitf112ea910e554d58b4b39a4492b7d302f0f4204f
treeed3b553fe43130c91115a59b8f5907ef9e3dd613
parentce1fed11d18e163baf7f875152a33bf80f625c1a
mei: bus: access mei_device under device_lock on cleanup

Fix couple of problems in mei_cl_bus_dev_release():

mei_cl_flush_queues() is running without lock.
bus->file_list access after mei_dev_bus_put(bus) can become a
use-after-free if this was the last reference to bus.

Protect queues cleanup and WARN traversal by device lock there
to avoid the concurrent access problems.
Move WARN traversal before mei_dev_bus_put(bus).

This file uses bus variable name for mei_device, adjust
code of mei_cl_bus_dev_release() to use bus variable too.

Cc: stable <stable@kernel.org>
Fixes: 35e8a426b16a ("mei: bus: Check for still connected devices in mei_cl_bus_dev_release()")
Reviewed-by: Menachem Adin <menachem.adin@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260705151259.3054795-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/mei/bus.c