mei: bus: Check for still connected devices in mei_cl_bus_dev_release()

[ Upstream commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 ]

mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl)
belonging to the device being released.

If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers,
the mei-client being freed might still be part of the mei_device's
file_list and iterating over this list after the freeing will then trigger
a use-afer-free bug.

Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed
mei-client is not on the mei_device's file_list.

Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250623085052.12347-11-hansg@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 7b7f4190cd0231856f2b970b2155c7b60d166dcc..19bc1e9eeb7f0eb20b4ea9b5903e86e6663d0b1c 100644 (file)
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -1113,6 +1113,8 @@ static void mei_dev_bus_put(struct mei_device *bus)
 static void mei_cl_bus_dev_release(struct device *dev)
 {
        struct mei_cl_device *cldev = to_mei_cl_device(dev);
+       struct mei_device *mdev = cldev->cl->dev;
+       struct mei_cl *cl;
 
        if (!cldev)
                return;
@@ -1120,6 +1122,10 @@ static void mei_cl_bus_dev_release(struct device *dev)
        mei_cl_flush_queues(cldev->cl, NULL);
        mei_me_cl_put(cldev->me_cl);
        mei_dev_bus_put(cldev->bus);
+
+       list_for_each_entry(cl, &mdev->file_list, link)
+               WARN_ON(cl == cldev->cl);
+
        kfree(cldev->cl);
        kfree(cldev);
 }