The Linux Kernel Mailing List
 help / color / mirror / Atom feed
* [char-misc-next v3 0/5] mei: fix mei_device lifetime
@ 2025-07-09 15:13 Alexander Usyskin
  2025-07-09 15:13 ` [char-misc-next v3 1/5] mei: set parent for char device Alexander Usyskin
                   ` (4 more replies)
  0 siblings, 5 replies; 10+ messages in thread
From: Alexander Usyskin @ 2025-07-09 15:13 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: Reuven Abliyev, Alexander Usyskin, linux-kernel

mei_device data structure is allocated using devm_* functions
and hooked to the parent device.
It works for client systems where parent device is pci one.
When parent device is auxiliary bus device produced by
graphics driver, the parent can be destroyed before child
and on the way it cleans all allocated memory.
This leads to use-after-free if mei character device is
opened when parent device is destroyed.

Connect mei_device structure lifteme to mei class device lifetime
by adding mei_device free to class device remove callback.
Decouple character device lifetime from parwnt structure lifetime.

As dev pointer in mei_device structure is converted to non-pointer
device all dev_* calls should be touched in this patch series.

Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14201

V2: Make cdev patches first to avoid double refcounting
    in the middle of the series.
    Replace manual refcount with special device.

V3: Use existing class device by Greg's insight, thanks!

Alexander Usyskin (5):
  mei: set parent for char device
  mei: make char device control its own lifetime
  mei: bus: use cldev in prints
  mei: more prints with client prefix
  mei: hook mei_device on class device

 drivers/misc/mei/bus-fixup.c    |  16 ++--
 drivers/misc/mei/bus.c          |  42 +++++-----
 drivers/misc/mei/client.c       |  82 +++++++++----------
 drivers/misc/mei/client.h       |   6 +-
 drivers/misc/mei/dma-ring.c     |   8 +-
 drivers/misc/mei/gsc-me.c       |  16 ++--
 drivers/misc/mei/hbm.c          | 135 +++++++++++++++-----------------
 drivers/misc/mei/hw-me.c        | 100 +++++++++++------------
 drivers/misc/mei/hw-txe.c       |  60 +++++++-------
 drivers/misc/mei/init.c         |  47 ++++++-----
 drivers/misc/mei/interrupt.c    |  47 ++++++-----
 drivers/misc/mei/main.c         | 135 +++++++++++++++++++-------------
 drivers/misc/mei/mei_dev.h      |  12 +--
 drivers/misc/mei/pci-me.c       |  20 ++---
 drivers/misc/mei/pci-txe.c      |   4 +-
 drivers/misc/mei/platform-vsc.c |  26 +++---
 16 files changed, 390 insertions(+), 366 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2025-07-17 11:54 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-09 15:13 [char-misc-next v3 0/5] mei: fix mei_device lifetime Alexander Usyskin
2025-07-09 15:13 ` [char-misc-next v3 1/5] mei: set parent for char device Alexander Usyskin
2025-07-10  5:31   ` Greg Kroah-Hartman
2025-07-16  9:47   ` Greg Kroah-Hartman
2025-07-09 15:13 ` [char-misc-next v3 2/5] mei: make char device control its own lifetime Alexander Usyskin
2025-07-16  9:54   ` Greg Kroah-Hartman
2025-07-17 11:54     ` Usyskin, Alexander
2025-07-09 15:13 ` [char-misc-next v3 3/5] mei: bus: use cldev in prints Alexander Usyskin
2025-07-09 15:13 ` [char-misc-next v3 4/5] mei: more prints with client prefix Alexander Usyskin
2025-07-09 15:13 ` [char-misc-next v3 5/5] mei: hook mei_device on class device Alexander Usyskin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox