mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl)
belonging to the device being released.

If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers,
the mei-client being freed might still be part of the mei_device's
file_list and iterating over this list after the freeing will then trigger
a use-afer-free bug.

Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed
mei-client is not on the mei_device's file_list.

Signed-off-by: Hans de Goede <hansg@kernel.org>
---
 drivers/misc/mei/bus.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 67176caf5416..1958c043ac14 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -1301,10 +1301,16 @@ static void mei_dev_bus_put(struct mei_device *bus)
 static void mei_cl_bus_dev_release(struct device *dev)
 {
 	struct mei_cl_device *cldev = to_mei_cl_device(dev);
+	struct mei_device *mdev = cldev->cl->dev;
+	struct mei_cl *cl;
 
 	mei_cl_flush_queues(cldev->cl, NULL);
 	mei_me_cl_put(cldev->me_cl);
 	mei_dev_bus_put(cldev->bus);
+
+	list_for_each_entry(cl, &mdev->file_list, link)
+		WARN_ON(cl == cldev->cl);
+
 	kfree(cldev->cl);
 	kfree(cldev);
 }
-- 
2.49.0

> Subject: [PATCH 10/10] mei: bus: Check for still connected devices in
> mei_cl_bus_dev_release()
> 
> mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl)
> belonging to the device being released.
> 
> If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers,
> the mei-client being freed might still be part of the mei_device's
> file_list and iterating over this list after the freeing will then trigger
> a use-afer-free bug.
> 
> Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed
> mei-client is not on the mei_device's file_list.
> 

Reviewed-by: Alexander Usyskin <alexander.usyskin@intel.com>

> Signed-off-by: Hans de Goede <hansg@kernel.org>
> ---
>  drivers/misc/mei/bus.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
> index 67176caf5416..1958c043ac14 100644
> --- a/drivers/misc/mei/bus.c
> +++ b/drivers/misc/mei/bus.c
> @@ -1301,10 +1301,16 @@ static void mei_dev_bus_put(struct mei_device
> *bus)
>  static void mei_cl_bus_dev_release(struct device *dev)
>  {
>  	struct mei_cl_device *cldev = to_mei_cl_device(dev);
> +	struct mei_device *mdev = cldev->cl->dev;
> +	struct mei_cl *cl;
> 
>  	mei_cl_flush_queues(cldev->cl, NULL);
>  	mei_me_cl_put(cldev->me_cl);
>  	mei_dev_bus_put(cldev->bus);
> +
> +	list_for_each_entry(cl, &mdev->file_list, link)
> +		WARN_ON(cl == cldev->cl);
> +
>  	kfree(cldev->cl);
>  	kfree(cldev);
>  }
> --
> 2.49.0