summaryrefslogtreecommitdiff
path: root/drivers/misc/mei
diff options
context:
space:
mode:
authorAlexander Usyskin <alexander.usyskin@intel.com>2019-01-30 11:12:26 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-01-30 17:24:45 +0300
commitcee4c4d63ba7b0df9b2d2a6724c41b2a260d72ec (patch)
treeaa13bf9f16f1621a4cda3ead872d73a143c32c68 /drivers/misc/mei
parentc4a46acf1db3ce547d290c29e55b3476c78dd76c (diff)
downloadlinux-cee4c4d63ba7b0df9b2d2a6724c41b2a260d72ec.tar.xz
mei: free read cb on ctrl_wr list flush
There is a little window during disconnection flow when read cb is moved between lists and may be not freed. Remove moving read cbs explicitly during flash fixes this memory leak. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/misc/mei')
-rw-r--r--drivers/misc/mei/client.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 1fc8ea0f519b..ca4c9cc218a2 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -401,8 +401,11 @@ static void mei_io_list_flush_cl(struct list_head *head,
struct mei_cl_cb *cb, *next;
list_for_each_entry_safe(cb, next, head, list) {
- if (cl == cb->cl)
+ if (cl == cb->cl) {
list_del_init(&cb->list);
+ if (cb->fop_type == MEI_FOP_READ)
+ mei_io_cb_free(cb);
+ }
}
}