mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 05:48:40 +00:00
mei: fix NULL dereferencing during FW initiated disconnection
In the case when disconnection is initiated from the FW the driver is flushing items from the write control list while iterating over it: mei_irq_write_handler() list_for_each_entry_safe(ctrl_wr_list) <-- outer loop mei_cl_irq_disconnect_rsp() mei_cl_set_disconnected() mei_io_list_flush(ctrl_wr_list) <-- destorying list We move the list flushing to the completion routine. Cc: <stable@vger.kernel.org> #4.2+ Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
cc25aa94e4
commit
6a8d648c8d
3 changed files with 6 additions and 6 deletions
|
@ -1766,6 +1766,10 @@ void mei_cl_complete(struct mei_cl *cl, struct mei_cl_cb *cb)
|
|||
if (waitqueue_active(&cl->wait))
|
||||
wake_up(&cl->wait);
|
||||
|
||||
break;
|
||||
case MEI_FOP_DISCONNECT_RSP:
|
||||
mei_io_cb_free(cb);
|
||||
mei_cl_set_disconnected(cl);
|
||||
break;
|
||||
default:
|
||||
BUG_ON(0);
|
||||
|
|
|
@ -877,8 +877,7 @@ static int mei_hbm_fw_disconnect_req(struct mei_device *dev,
|
|||
cb = mei_io_cb_init(cl, MEI_FOP_DISCONNECT_RSP, NULL);
|
||||
if (!cb)
|
||||
return -ENOMEM;
|
||||
cl_dbg(dev, cl, "add disconnect response as first\n");
|
||||
list_add(&cb->list, &dev->ctrl_wr_list.list);
|
||||
list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
|
|
@ -194,10 +194,7 @@ static int mei_cl_irq_disconnect_rsp(struct mei_cl *cl, struct mei_cl_cb *cb,
|
|||
return -EMSGSIZE;
|
||||
|
||||
ret = mei_hbm_cl_disconnect_rsp(dev, cl);
|
||||
mei_cl_set_disconnected(cl);
|
||||
mei_io_cb_free(cb);
|
||||
mei_me_cl_put(cl->me_cl);
|
||||
cl->me_cl = NULL;
|
||||
list_move_tail(&cb->list, &cmpl_list->list);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue