From: Alexander Usyskin <alexander.usyskin@intel.com>
Date: Wed, 30 Jan 2019 08:12:26 +0000 (+0200)
Subject: mei: free read cb on ctrl_wr list flush
X-Git-Tag: v5.15~7033^2~5
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=cee4c4d63ba7b0df9b2d2a6724c41b2a260d72ec;p=platform%2Fkernel%2Flinux-starfive.git

mei: free read cb on ctrl_wr list flush

There is a little window during disconnection flow
when read cb is moved between lists and may be not freed.
Remove moving read cbs explicitly during flash fixes this memory
leak.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 1fc8ea0..ca4c9cc 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -401,8 +401,11 @@ static void mei_io_list_flush_cl(struct list_head *head,
 	struct mei_cl_cb *cb, *next;
 
 	list_for_each_entry_safe(cb, next, head, list) {
-		if (cl == cb->cl)
+		if (cl == cb->cl) {
 			list_del_init(&cb->list);
+			if (cb->fop_type == MEI_FOP_READ)
+				mei_io_cb_free(cb);
+		}
 	}
 }