• Chao Bi's avatar
    mei: set client's read_cb to NULL when flow control fails · accb884b
    Chao Bi authored
    In mei_cl_read_start(), if it fails to send flow control request, it
    will release "cl->read_cb" but forget to set pointer to NULL, leaving
    "cl->read_cb" still pointing to random memory, next time this client is
    operated like mei_release(), it has chance to refer to this wrong pointer.
    
    Fixes:  PANIC at kfree in mei_release()
    
    [228781.826904] Call Trace:
    [228781.829737]  [<c16249b8>] ? mei_cl_unlink+0x48/0xa0
    [228781.835283]  [<c1624487>] mei_io_cb_free+0x17/0x30
    [228781.840733]  [<c16265d8>] mei_release+0xa8/0x180
    [228781.845989]  [<c135c610>] ? __fsnotify_parent+0xa0/0xf0
    [228781.851925]  [<c1325a69>] __fput+0xd9/0x200
    [228781.856696]  [<c1325b9d>] ____fput+0xd/0x10
    [228781.861467]  [<c125cae1>] task_work_run+0x81/0xb0
    [228781.866821]  [<c1242e53>] do_exit+0x283/0xa00
    [228781.871786]  [<c1a82b36>] ? kprobe_flush_task+0x66/0xc0
    [228781.877722]  [<c124eeb8>] ? __dequeue_signal+0x18/0x1a0
    [228781.883657]  [<c124f072>] ? dequeue_signal+0x32/0x190
    [228781.889397]  [<c1243744>] do_group_exit+0x34/0xa0
    [228781.894750]  [<c12517b6>] get_signal_to_deliver+0x206/0x610
    [228781.901075]  [<c12018d8>] do_signal+0x38/0x100
    [228781.906136]  [<c1626d1c>] ? mei_read+0x42c/0x4e0
    [228781.911393]  [<c12600a0>] ? wake_up_bit+0x30/0x30
    [228781.916745]  [<c16268f0>] ? mei_poll+0x120/0x120
    [228781.922001]  [<c1324be9>] ? vfs_read+0x89/0x160
    [228781.927158]  [<c16268f0>] ? mei_poll+0x120/0x120
    [228781.932414]  [<c133ca34>] ? fget_light+0x44/0xe0
    [228781.937670]  [<c1324e58>] ? SyS_read+0x68/0x80
    [228781.942730]  [<c12019f5>] do_notify_resume+0x55/0x70
    [228781.948376]  [<c1a7de5d>] work_notifysig+0x29/0x30
    [228781.953827]  [<c1a70000>] ? bad_area+0x5/0x3e
    
    Cc: stable <stable@vger.kernel.org> # 3.9+
    Signed-off-by: default avatarChao Bi <chao.bi@intel.com>
    Signed-off-by: default avatarTomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    accb884b
client.c 20 KB