leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

greybus: operation: fix cancellation use-after-free

Browse Source 
The final reference of an operation will be put after its completion
handler has run, so we must not drop the reference if it has already
been scheduled to avoid use-after-free.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Johan Hovold 2015-07-01 12:37:25 +02:00 committed by Greg Kroah-Hartman
parent abb722e79a
commit 73f9d73f12
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/staging/greybus/operation.c
View File

@ -846,9 +846,9 @@ void gb_operation_cancel(struct gb_operation *operation, int errno)
gb_message_cancel(operation->request); gb_message_cancel(operation->request);
if (operation->response) if (operation->response)
gb_message_cancel(operation->response); gb_message_cancel(operation->response);
}
gb_operation_put(operation); gb_operation_put(operation);
} }
}
EXPORT_SYMBOL_GPL(gb_operation_cancel); EXPORT_SYMBOL_GPL(gb_operation_cancel);
/** /**