Commit a4386685 authored by Alexander Usyskin's avatar Alexander Usyskin Committed by Greg Kroah-Hartman
Browse files

mei: bus: fix unlink on bus in error path 



Unconditional call to mei_cl_unlink in mei_cl_bus_dev_release leads
to call of the mei_cl_unlink without corresponding mei_cl_link.
This leads to miscalculation of open_handle_count (decrease without
increase).

Call unlink in mei_cldev_enable fail path and remove blanket unlink
from mei_cl_bus_dev_release.

Fixes: 34f1166a ("mei: bus: need to unlink client before freeing")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAlexander Usyskin <alexander.usyskin@intel.com>
Reviewed-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20221212220247.286019-1-tomas.winkler@intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 732065df

drivers/misc/mei/bus.c

+8 −4
Original line number Diff line number Diff line
@@ -702,13 +702,15 @@ void *mei_cldev_dma_map(struct mei_cl_device *cldev, u8 buffer_id, size_t size) 
	if (cl->state == MEI_FILE_UNINITIALIZED) {

		ret = mei_cl_link(cl);

		if (ret)

			goto out;

			goto notlinked;

		/* update pointers */

		cl->cldev = cldev;

	}



	ret = mei_cl_dma_alloc_and_map(cl, NULL, buffer_id, size);

out:

	if (ret)

		mei_cl_unlink(cl);

notlinked:

	mutex_unlock(&bus->device_lock);

	if (ret)

		return ERR_PTR(ret);
@@ -758,7 +760,7 @@ int mei_cldev_enable(struct mei_cl_device *cldev) 
	if (cl->state == MEI_FILE_UNINITIALIZED) {

		ret = mei_cl_link(cl);

		if (ret)

			goto out;

			goto notlinked;

		/* update pointers */

		cl->cldev = cldev;

	}
@@ -785,6 +787,9 @@ int mei_cldev_enable(struct mei_cl_device *cldev) 
	}



out:

	if (ret)

		mei_cl_unlink(cl);

notlinked:

	mutex_unlock(&bus->device_lock);



	return ret;
@@ -1277,7 +1282,6 @@ static void mei_cl_bus_dev_release(struct device *dev) 
	mei_cl_flush_queues(cldev->cl, NULL);

	mei_me_cl_put(cldev->me_cl);

	mei_dev_bus_put(cldev->bus);

	mei_cl_unlink(cldev->cl);

	kfree(cldev->cl);

	kfree(cldev);

}