Commit fffc1513 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

greybus: operation: fix another cancellation use-after-free 



An incoming operation could already be scheduled even if
gb_operation_result_set succeeds as its initial status is -EINPROGRESS.

Avoid potential use-after-free by never dropping the reference count for
incoming operations as part of cancellation.

Signed-off-by: default avatarJohan Hovold <johan@hovoldconsulting.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parent a5192032

drivers/staging/greybus/operation.c

+10 −5
Original line number Diff line number Diff line
@@ -853,12 +853,17 @@ void gb_connection_recv(struct gb_connection *connection, 
 */

void gb_operation_cancel(struct gb_operation *operation, int errno)

{

	if (gb_operation_is_incoming(operation)) {

		/* Cancel response if it has been allocated */

		if (!gb_operation_result_set(operation, errno) &&

				!gb_operation_is_unidirectional(operation)) {

			gb_message_cancel(operation->response);

		}

	} else {

		if (gb_operation_result_set(operation, errno)) {

			gb_message_cancel(operation->request);

			gb_operation_put(operation);

	} else if (gb_operation_is_incoming(operation)) {

		if (!gb_operation_is_unidirectional(operation))

			gb_message_cancel(operation->response);

		}

	}

}

EXPORT_SYMBOL_GPL(gb_operation_cancel);