Commit cee4c4d6 authored Jan 30, 2019 by Alexander Usyskin Committed by Greg Kroah-Hartman Jan 30, 2019

mei: free read cb on ctrl_wr list flush



There is a little window during disconnection flow
when read cb is moved between lists and may be not freed.
Remove moving read cbs explicitly during flash fixes this memory
leak.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent c4a46acf

drivers/misc/mei/client.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -401,8 +401,11 @@ static void mei_io_list_flush_cl(struct list_head *head,
		struct mei_cl_cb cb, next;

		list_for_each_entry_safe(cb, next, head, list) {
		if (cl == cb->cl)
		if (cl == cb->cl) {
		list_del_init(&cb->list);
		if (cb->fop_type == MEI_FOP_READ)
		mei_io_cb_free(cb);
		}
		}
		}