1 files changed, 12 insertions, 3 deletions

diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 1ee2b9492a82..89a557972d1b 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -666,7 +666,6 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
                 goto err;
 
         cb->fop_type = MEI_FOP_READ;
-        cl->read_cb = cb;
         if (dev->hbuf_is_ready) {
                 dev->hbuf_is_ready = false;
                 if (mei_hbm_cl_flow_control_req(dev, cl)) {
@@ -678,6 +677,9 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
         } else {
                 list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
         }
+
+        cl->read_cb = cb;
+
         return rets;
 err:
         mei_io_cb_free(cb);
@@ -908,7 +910,6 @@ void mei_cl_all_disconnect(struct mei_device *dev)
         list_for_each_entry_safe(cl, next, &dev->file_list, link) {
                 cl->state = MEI_FILE_DISCONNECTED;
                 cl->mei_flow_ctrl_creds = 0;
-                cl->read_cb = NULL;
                 cl->timer_count = 0;
         }
 }
@@ -942,8 +943,16 @@ void mei_cl_all_wakeup(struct mei_device *dev)
 void mei_cl_all_write_clear(struct mei_device *dev)
 {
         struct mei_cl_cb *cb, *next;
+        struct list_head *list;
+
+        list = &dev->write_list.list;
+        list_for_each_entry_safe(cb, next, list, list) {
+                list_del(&cb->list);
+                mei_io_cb_free(cb);
+        }
 
-        list_for_each_entry_safe(cb, next, &dev->write_list.list, list) {
+        list = &dev->write_waiting_list.list;
+        list_for_each_entry_safe(cb, next, list, list) {
                 list_del(&cb->list);
                 mei_io_cb_free(cb);
         }