mei: free read cb on ctrl_wr list flush

ausyskin · gregkh · commit cee4c4d63ba7 · 2019-01-30T15:24:45.000+01:00
There is a little window during disconnection flow
when read cb is moved between lists and may be not freed.
Remove moving read cbs explicitly during flash fixes this memory
leak.

Signed-off-by: Alexander Usyskin &lt;alexander.usyskin@intel.com&gt;
Signed-off-by: Tomas Winkler &lt;tomas.winkler@intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
@@ -401,8 +401,11 @@ static void mei_io_list_flush_cl(struct list_head *head,
 	struct mei_cl_cb *cb, *next;
 
 	list_for_each_entry_safe(cb, next, head, list) {
-		if (cl == cb->cl)
+		if (cl == cb->cl) {
 			list_del_init(&cb->list);
+			if (cb->fop_type == MEI_FOP_READ)
+				mei_io_cb_free(cb);
+		}
 	}
 }
 

Original file line number	Diff line number	Diff line change
`@@ -401,8 +401,11 @@ static void mei_io_list_flush_cl(struct list_head *head,`
`401`	`401`	`struct mei_cl_cb cb, next;`
`402`	`402`
`403`	`403`	`list_for_each_entry_safe(cb, next, head, list) {`
`404`		`- if (cl == cb->cl)`
	`404`	`+ if (cl == cb->cl) {`
`405`	`405`	`list_del_init(&cb->list);`
	`406`	`+ if (cb->fop_type == MEI_FOP_READ)`
	`407`	`+ mei_io_cb_free(cb);`
	`408`	`+ }`
`406`	`409`	`}`
`407`	`410`	`}`
`408`	`411`