[char-misc-next] mei: bus: fix device leak

From: Alexander Usyskin
Date: Tue Jun 24 2025 - 03:28:56 EST


The bus rescan function creates bus devices for all clients.
The fixup routine is executed on all devices, unneeded
devices are removed and fully initialized once set
is_added flag to 1.

If link to firmware is reset right after all devices are
initialized, but before fixup is executed, the rescan tries
to remove devices.
The is_added flag is not set and the mei_cl_bus_dev_destroy
returns prematurely.
Allow to clean up device when is_added flag is unset to
account for above scenario.

Signed-off-by: Alexander Usyskin <alexander.usyskin@xxxxxxxxx>
---
drivers/misc/mei/bus.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 67176caf5416..f2e5d550c6b4 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -1430,17 +1430,14 @@ static void mei_cl_bus_dev_stop(struct mei_cl_device *cldev)
*/
static void mei_cl_bus_dev_destroy(struct mei_cl_device *cldev)
{
-
WARN_ON(!mutex_is_locked(&cldev->bus->cl_bus_lock));

- if (!cldev->is_added)
- return;
-
- device_del(&cldev->dev);
+ if (cldev->is_added) {
+ device_del(&cldev->dev);
+ cldev->is_added = 0;
+ }

list_del_init(&cldev->bus_list);
-
- cldev->is_added = 0;
put_device(&cldev->dev);
}

--
2.43.0