mei: fix NULL dereferencing during FW initiated disconnection
authorAlexander Usyskin <alexander.usyskin@intel.com>
Sun, 17 Apr 2016 16:16:03 +0000 (12:16 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 30 Apr 2016 21:08:08 +0000 (14:08 -0700)
commit6a8d648c8d1824117a9e9edb948ed1611fb013c0
treed0db8401ceee131be91539da604aa9a5af9a6176
parentcc25aa94e43779b86300c443acb6947dd739fdd1
mei: fix NULL dereferencing during FW initiated disconnection

In the case when disconnection is initiated from the FW
the driver is flushing items from the write control list while
iterating over it:

mei_irq_write_handler()
    list_for_each_entry_safe(ctrl_wr_list)         <-- outer loop
         mei_cl_irq_disconnect_rsp()
             mei_cl_set_disconnected()
                 mei_io_list_flush(ctrl_wr_list)   <-- destorying list

We move the list flushing to the completion routine.

Cc: <stable@vger.kernel.org> #4.2+
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/mei/client.c
drivers/misc/mei/hbm.c
drivers/misc/mei/interrupt.c