diff options
| author | Alexander Usyskin <alexander.usyskin@intel.com> | 2016-02-10 23:57:26 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-02-11 19:23:28 -0800 |
| commit | 6cbb097fd3903fd6b419303ee8dc7f72b47d06f0 (patch) | |
| tree | 13d2152de62e022094670c248962f5c83c702f55 /drivers/misc/mei/client.c | |
| parent | 3ca9b1ac28398c6fe0bed335d2d71a35e1c5f7c9 (diff) | |
| download | linux-6cbb097fd3903fd6b419303ee8dc7f72b47d06f0.tar.bz2 | |
mei: fix double freeing of a cb during link reset
Fix double freeing of the cb that can happen if link reset kicks in the
middle of blocked write from a device on the cl bus.
Free cb inside mei_cl_write function on failure and drop cb free
operation from callers, during a link reset the mei_cl_write function
returns with an error, but the caller doesn't know if the cb was
already queued or not so it doesn't know if the cb will be freed upon
queue reclaim or it has to free it itself.
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/misc/mei/client.c')
| -rw-r--r-- | drivers/misc/mei/client.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c index af6816bc268f..a9cdb92b52d1 100644 --- a/drivers/misc/mei/client.c +++ b/drivers/misc/mei/client.c @@ -1645,7 +1645,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking) if (rets < 0 && rets != -EINPROGRESS) { pm_runtime_put_noidle(dev->dev); cl_err(dev, cl, "rpm: get failed %d\n", rets); - return rets; + goto free; } cb->buf_idx = 0; @@ -1724,6 +1724,8 @@ err: cl_dbg(dev, cl, "rpm: autosuspend\n"); pm_runtime_mark_last_busy(dev->dev); pm_runtime_put_autosuspend(dev->dev); +free: + mei_io_cb_free(cb); return rets; } |