https://github.com/torvalds/linux
Revision 34f1166afd67f9f48a08c52f36180048908506a4 authored by Tomas Winkler on 27 August 2018, 19:40:16 UTC, committed by Greg Kroah-Hartman on 12 September 2018, 07:14:24 UTC
In case a client fails to connect in mei_cldev_enable(), the
caller won't call the mei_cldev_disable leaving the client
in a linked stated. Upon driver unload the client structure
will be freed in  mei_cl_bus_dev_release(), leaving a stale pointer
on a fail_list.  This will eventually end up in crash
during power down flow in mei_cl_set_disonnected().

RIP:  mei_cl_set_disconnected+0x5/0x260[mei]
Call trace:
mei_cl_all_disconnect+0x22/0x30
mei_reset+0x194/0x250
__synchronize_hardirq+0x43/0x50
_cond_resched+0x15/0x30
mei_me_intr_clear+0x20/0x100
mei_stop+0x76/0xb0
mei_me_shutdown+0x3f/0x80
pci_device_shutdown+0x34/0x60
kernel_restart+0x0e/0x30

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200455
Fixes: 'c110cdb17148 ("mei: bus: make a client pointer always available")'
Cc: <stable@vger.kernel.org> 4.10+
Tested-by: Georg Müller <georgmueller@gmx.net>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 69bf531
History
Tip revision: 34f1166afd67f9f48a08c52f36180048908506a4 authored by Tomas Winkler on 27 August 2018, 19:40:16 UTC
mei: bus: need to unlink client before freeing
Tip revision: 34f1166
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 12.8 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.5 KB
.mailmap -rw-r--r-- 9.7 KB
COPYING -rw-r--r-- 423 bytes
CREDITS -rw-r--r-- 96.4 KB
Kbuild -rw-r--r-- 2.2 KB
Kconfig -rw-r--r-- 563 bytes
MAINTAINERS -rw-r--r-- 458.5 KB
Makefile -rw-r--r-- 59.1 KB
README -rw-r--r-- 800 bytes

README

back to top