iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

greybus: operation: fix null-deref on operation cancel

Browse Source 
Incoming operations are created without a response message. If an
operation were to be cancelled before it has been fully processed (e.g.
on connection destroy), we would get a null-pointer dereference in
gb_operation_cancel.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
This commit is contained in:
Johan Hovold 2015-03-27 12:41:16 +01:00 committed by Greg Kroah-Hartman
parent ff65be7a58
commit 772f3e9060
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/staging/greybus/operation.c
View File

@ -911,7 +911,8 @@ void gb_operation_cancel(struct gb_operation *operation, int errno)
{
if (gb_operation_result_set(operation, errno)) {
gb_message_cancel(operation->request);
gb_message_cancel(operation->response);
if (operation->response)
gb_message_cancel(operation->response);
}
gb_operation_put(operation);
}