iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

greybus: operation: fix use-after-free in response receive path

Browse Source 
Fix potential use-after-free in response receive path, due to lack of
reference counting when looking up operations on a connection.

Make sure to acquire a reference to the operation while holding the
connection-list lock.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Johan Hovold 2015-07-09 15:17:59 +02:00 committed by Greg Kroah-Hartman
parent 85109f7ddd
commit 0581f28efb
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/staging/greybus/operation.c
View File

@ -114,6 +114,10 @@ int gb_operation_result(struct gb_operation *operation)
} }
EXPORT_SYMBOL_GPL(gb_operation_result); EXPORT_SYMBOL_GPL(gb_operation_result);
/*
* Looks up an operation on a connection and returns a refcounted pointer if
* found, or NULL otherwise.
*/
static struct gb_operation * static struct gb_operation *
gb_operation_find(struct gb_connection *connection, u16 operation_id) gb_operation_find(struct gb_connection *connection, u16 operation_id)
{ {
@ -124,6 +128,7 @@ gb_operation_find(struct gb_connection *connection, u16 operation_id)
spin_lock_irqsave(&gb_operations_lock, flags); spin_lock_irqsave(&gb_operations_lock, flags);
list_for_each_entry(operation, &connection->operations, links) list_for_each_entry(operation, &connection->operations, links)
if (operation->id == operation_id) { if (operation->id == operation_id) {
gb_operation_get(operation);
found = true; found = true;
break; break;
} }
@ -795,6 +800,8 @@ static void gb_connection_recv_response(struct gb_connection *connection,
/* The rest will be handled in work queue context */ /* The rest will be handled in work queue context */
if (gb_operation_result_set(operation, errno)) if (gb_operation_result_set(operation, errno))
queue_work(gb_operation_workqueue, &operation->work); queue_work(gb_operation_workqueue, &operation->work);
gb_operation_put(operation);
} }
/* /*