Re: [char-misc-next v2 0/5] mei: fix mei_device lifetime

[Greg Kroah-Hartman]

On Mon, Jun 30, 2025 at 12:19:37PM +0300, Alexander Usyskin wrote:
> mei_device data structure is allocated using devm_* functions
> and hooked to the parent device.
> It works for client systems where parent device is pci one.
> When parent device is auxiliary bus device produced by
> graphics driver, the parent can be destroyed before child
> and on the way it cleans all allocated memory.
> This leads to use-after-free if mei character device is
> opened when parent device is destroyed.
> Introduce device to hook the mei_device lifetime on it and
> decouple cdev from main structure to allow all memory
> to be released when it is unused and not before.

How was any of this tested?