UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

greybus: operation: fix null-deref on operation destroy 

Incoming operations are created without a response message. If a
protocol driver fails to send a response, or if the operation were to be
cancelled before it has been fully processed, we get a null-pointer
dereference when the operation is released.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
This commit is contained in:
Johan Hovold 2015-03-27 12:41:17 +01:00 committed by Greg Kroah-Hartman
parent 772f3e9060
commit 9489667684
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/staging/greybus/operation.c
View File

@ -607,7 +607,8 @@ static void _gb_operation_destroy(struct kref *kref)
list_del(&operation->links);
spin_unlock_irqrestore(&gb_operations_lock, flags);
gb_operation_message_free(operation->response);
if (operation->response)
gb_operation_message_free(operation->response);
gb_operation_message_free(operation->request);
kmem_cache_free(gb_operation_cache, operation);