From: Alexander Usyskin <alexander.usyskin@intel.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Reuven Abliyev <reuven.abliyev@intel.com>,
Alexander Usyskin <alexander.usyskin@intel.com>,
linux-kernel@vger.kernel.org
Subject: [char-misc-next v2 0/5] mei: fix mei_device lifetime
Date: Mon, 30 Jun 2025 12:19:37 +0300 [thread overview]
Message-ID: <20250630091942.2116676-1-alexander.usyskin@intel.com> (raw)
mei_device data structure is allocated using devm_* functions
and hooked to the parent device.
It works for client systems where parent device is pci one.
When parent device is auxiliary bus device produced by
graphics driver, the parent can be destroyed before child
and on the way it cleans all allocated memory.
This leads to use-after-free if mei character device is
opened when parent device is destroyed.
Introduce device to hook the mei_device lifetime on it and
decouple cdev from main structure to allow all memory
to be released when it is unused and not before.
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14201
V2: Make cdev patches first to avoid double refcounting
in the middle of the series.
Replace manual refcount with special device.
Alexander Usyskin (5):
mei: set parent for char device
mei: make char device control its own lifetime
mei: bus: use cldev in prints
mei: more prints with client prefix
mei: create dedicated device object
drivers/misc/mei/bus-fixup.c | 16 ++--
drivers/misc/mei/bus.c | 42 +++++-----
drivers/misc/mei/client.c | 82 +++++++++----------
drivers/misc/mei/client.h | 6 +-
drivers/misc/mei/dma-ring.c | 8 +-
drivers/misc/mei/gsc-me.c | 13 +--
drivers/misc/mei/hbm.c | 135 +++++++++++++++-----------------
drivers/misc/mei/hw-me.c | 101 ++++++++++++------------
drivers/misc/mei/hw-txe.c | 62 +++++++--------
drivers/misc/mei/init.c | 85 ++++++++++++++------
drivers/misc/mei/interrupt.c | 47 ++++++-----
drivers/misc/mei/main.c | 99 ++++++++++++-----------
drivers/misc/mei/mei_dev.h | 15 ++--
drivers/misc/mei/pci-me.c | 12 ++-
drivers/misc/mei/pci-txe.c | 10 ++-
drivers/misc/mei/platform-vsc.c | 18 +++--
16 files changed, 404 insertions(+), 347 deletions(-)
--
2.43.0
next reply other threads:[~2025-06-30 9:33 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-30 9:19 Alexander Usyskin [this message]
2025-06-30 9:19 ` [char-misc-next v2 1/5] mei: set parent for char device Alexander Usyskin
2025-06-30 10:02 ` Greg Kroah-Hartman
2025-06-30 13:02 ` Usyskin, Alexander
2025-06-30 13:13 ` Greg Kroah-Hartman
2025-07-16 7:44 ` Usyskin, Alexander
2025-07-16 7:47 ` Greg Kroah-Hartman
2025-07-16 8:09 ` Usyskin, Alexander
2025-06-30 9:19 ` [char-misc-next v2 2/5] mei: make char device control its own lifetime Alexander Usyskin
2025-06-30 17:24 ` Greg Kroah-Hartman
2025-06-30 9:19 ` [char-misc-next v2 3/5] mei: bus: use cldev in prints Alexander Usyskin
2025-06-30 9:19 ` [char-misc-next v2 4/5] mei: more prints with client prefix Alexander Usyskin
2025-06-30 17:25 ` Greg Kroah-Hartman
2025-07-01 10:13 ` Usyskin, Alexander
2025-06-30 9:19 ` [char-misc-next v2 5/5] mei: create dedicated device object Alexander Usyskin
2025-06-30 17:27 ` Greg Kroah-Hartman
2025-07-01 10:55 ` Usyskin, Alexander
2025-06-30 10:02 ` [char-misc-next v2 0/5] mei: fix mei_device lifetime Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250630091942.2116676-1-alexander.usyskin@intel.com \
--to=alexander.usyskin@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=reuven.abliyev@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).