mei: fix NULL dereferencing during FW initiated disconnection
authorAlexander Usyskin <alexander.usyskin@intel.com>
Sun, 17 Apr 2016 16:16:03 +0000 (12:16 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 30 Apr 2016 21:08:08 +0000 (14:08 -0700)
In the case when disconnection is initiated from the FW
the driver is flushing items from the write control list while
iterating over it:

mei_irq_write_handler()
    list_for_each_entry_safe(ctrl_wr_list)         <-- outer loop
         mei_cl_irq_disconnect_rsp()
             mei_cl_set_disconnected()
                 mei_io_list_flush(ctrl_wr_list)   <-- destorying list

We move the list flushing to the completion routine.

Cc: <stable@vger.kernel.org> #4.2+
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/mei/client.c
drivers/misc/mei/hbm.c
drivers/misc/mei/interrupt.c

index bab17e4..09f5280 100644 (file)
@@ -1766,6 +1766,10 @@ void mei_cl_complete(struct mei_cl *cl, struct mei_cl_cb *cb)
                if (waitqueue_active(&cl->wait))
                        wake_up(&cl->wait);
 
+               break;
+       case MEI_FOP_DISCONNECT_RSP:
+               mei_io_cb_free(cb);
+               mei_cl_set_disconnected(cl);
                break;
        default:
                BUG_ON(0);
index 5eaa463..5aa606c 100644 (file)
@@ -877,8 +877,7 @@ static int mei_hbm_fw_disconnect_req(struct mei_device *dev,
                cb = mei_io_cb_init(cl, MEI_FOP_DISCONNECT_RSP, NULL);
                if (!cb)
                        return -ENOMEM;
-               cl_dbg(dev, cl, "add disconnect response as first\n");
-               list_add(&cb->list, &dev->ctrl_wr_list.list);
+               list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
        }
        return 0;
 }
index 1e5cb1f..704dc6c 100644 (file)
@@ -194,10 +194,7 @@ static int mei_cl_irq_disconnect_rsp(struct mei_cl *cl, struct mei_cl_cb *cb,
                return -EMSGSIZE;
 
        ret = mei_hbm_cl_disconnect_rsp(dev, cl);
-       mei_cl_set_disconnected(cl);
-       mei_io_cb_free(cb);
-       mei_me_cl_put(cl->me_cl);
-       cl->me_cl = NULL;
+       list_move_tail(&cb->list, &cmpl_list->list);
 
        return ret;
 }