mei: fix double freeing of a cb during link reset
authorAlexander Usyskin <alexander.usyskin@intel.com>
Wed, 10 Feb 2016 21:57:26 +0000 (23:57 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 12 Feb 2016 03:23:28 +0000 (19:23 -0800)
commit6cbb097fd3903fd6b419303ee8dc7f72b47d06f0
tree13d2152de62e022094670c248962f5c83c702f55
parent3ca9b1ac28398c6fe0bed335d2d71a35e1c5f7c9
mei: fix double freeing of a cb during link reset

Fix double freeing of the cb that can happen if link reset kicks  in the
middle of blocked write from a device on the cl bus.

Free cb inside mei_cl_write function on failure and drop cb free
operation from callers, during a link reset the mei_cl_write function
returns with an error,  but the caller doesn't know if the cb was
already queued or not so it doesn't know if the cb will be freed upon
queue reclaim or it has to free it itself.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/mei/bus.c
drivers/misc/mei/client.c
drivers/misc/mei/main.c