mei: bus: access mei_device under device_lock on cleanup

Fix couple of problems in mei_cl_bus_dev_release():

mei_cl_flush_queues() is running without lock.
bus->file_list access after mei_dev_bus_put(bus) can become a
use-after-free if this was the last reference to bus.

Protect queues cleanup and WARN traversal by device lock there
to avoid the concurrent access problems.
Move WARN traversal before mei_dev_bus_put(bus).

This file uses bus variable name for mei_device, adjust
code of mei_cl_bus_dev_release() to use bus variable too.

Cc: stable <stable@kernel.org>
Fixes: 35e8a426b16a ("mei: bus: Check for still connected devices in mei_cl_bus_dev_release()")
Reviewed-by: Menachem Adin <menachem.adin@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260705151259.3054795-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index fcde082eb5e3102ed707e460e465ed5d146e116a..cfb87ab8667f848ae49b7b30d8b8177f9c9e53a5 100644 (file)
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -4,6 +4,7 @@
  * Intel Management Engine Interface (Intel MEI) Linux driver
  */
 
+#include <linux/cleanup.h>
 #include <linux/module.h>
 #include <linux/device.h>
 #include <linux/kernel.h>
@@ -1330,15 +1331,16 @@ static void mei_dev_bus_put(struct mei_device *bus)
 static void mei_cl_bus_dev_release(struct device *dev)
 {
        struct mei_cl_device *cldev = to_mei_cl_device(dev);
-       struct mei_device *mdev = cldev->cl->dev;
+       struct mei_device *bus = cldev->bus;
        struct mei_cl *cl;
 
-       mei_cl_flush_queues(cldev->cl, NULL);
-       mei_me_cl_put(cldev->me_cl);
-       mei_dev_bus_put(cldev->bus);
-
-       list_for_each_entry(cl, &mdev->file_list, link)
-               WARN_ON(cl == cldev->cl);
+       scoped_guard(mutex, &bus->device_lock) {
+               mei_cl_flush_queues(cldev->cl, NULL);
+               mei_me_cl_put(cldev->me_cl);
+               list_for_each_entry(cl, &bus->file_list, link)
+                       WARN_ON(cl == cldev->cl);
+       }
+       mei_dev_bus_put(bus);
 
        kfree(cldev->cl);
        kfree(cldev);