mei: do not access freed cb in blocking write
authorAlexander Usyskin <alexander.usyskin@intel.com>
Thu, 23 Jul 2015 07:43:11 +0000 (10:43 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 4 Aug 2015 00:19:09 +0000 (17:19 -0700)
commit23253c31c6a7a3c5a437ec31830e2100484c0748
tree70ceab86a3e5e9fb1abab3359143b04ef09c5cdc
parent0bd38ae355227792dde3487779a9dc24d6b99631
mei: do not access freed cb in blocking write

The mei_cl_write function is giving up on a write cb ownership after it
was sent or queued. The write cb is then freed in the completion
handler. Especially during blocking write mei_cl_write function waits
for the completion handler and then access the freed memory to fetch the
written size.  The quick fix is to store the buffer size prior to
sending, the size is not altered during the flow.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/mei/client.c