The bus rescan function creates bus devices for all clients.
The fixup routine is executed on all devices, unneeded
devices are removed and fully initialized once set
is_added flag to 1.

If link to firmware is reset right after all devices are
initialized, but before fixup is executed, the rescan tries
to remove devices.
The is_added flag is not set and the mei_cl_bus_dev_destroy
returns prematurely.
Allow to clean up device when is_added flag is unset to
account for above scenario.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
---
 drivers/misc/mei/bus.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 67176caf5416..f2e5d550c6b4 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -1430,17 +1430,14 @@ static void mei_cl_bus_dev_stop(struct mei_cl_device *cldev)
  */
 static void mei_cl_bus_dev_destroy(struct mei_cl_device *cldev)
 {
-
 	WARN_ON(!mutex_is_locked(&cldev->bus->cl_bus_lock));
 
-	if (!cldev->is_added)
-		return;
-
-	device_del(&cldev->dev);
+	if (cldev->is_added) {
+		device_del(&cldev->dev);
+		cldev->is_added = 0;
+	}
 
 	list_del_init(&cldev->bus_list);
-
-	cldev->is_added = 0;
 	put_device(&cldev->dev);
 }
 
-- 
2.43.0

On Tue, Jun 24, 2025 at 10:15:21AM +0300, Alexander Usyskin wrote:
> The bus rescan function creates bus devices for all clients.
> The fixup routine is executed on all devices, unneeded
> devices are removed and fully initialized once set
> is_added flag to 1.
> 
> If link to firmware is reset right after all devices are
> initialized, but before fixup is executed, the rescan tries
> to remove devices.
> The is_added flag is not set and the mei_cl_bus_dev_destroy
> returns prematurely.
> Allow to clean up device when is_added flag is unset to
> account for above scenario.
> 
> Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>

What commit id does this fix?

thanks,

greg k-h

> Subject: Re: [char-misc-next] mei: bus: fix device leak
> 
> On Tue, Jun 24, 2025 at 10:15:21AM +0300, Alexander Usyskin wrote:
> > The bus rescan function creates bus devices for all clients.
> > The fixup routine is executed on all devices, unneeded
> > devices are removed and fully initialized once set
> > is_added flag to 1.
> >
> > If link to firmware is reset right after all devices are
> > initialized, but before fixup is executed, the rescan tries
> > to remove devices.
> > The is_added flag is not set and the mei_cl_bus_dev_destroy
> > returns prematurely.
> > Allow to clean up device when is_added flag is unset to
> > account for above scenario.
> >
> > Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
> 
> What commit id does this fix?
> 
> thanks,
> 
> greg k-h

This is the one that introduces this function:
commit 6009595a66e4 ("mei: bus: link client devices instead of host clients")

Will send v2 with Fixes tag.

- - 
Thanks,
Sasha