diff options
| author | Johan Hovold <johan@hovoldconsulting.com> | 2015-07-01 12:37:25 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@google.com> | 2015-07-01 16:50:59 -0700 |
| commit | 73f9d73f124ccba16403971b5101d4a947161481 (patch) | |
| tree | ca2abe90694102e96f22a72c4db4508b0a9411da /drivers/staging/greybus/operation.c | |
| parent | abb722e79a07b0a438a3782fd3f7d8c85f541d5f (diff) | |
greybus: operation: fix cancellation use-after-free
The final reference of an operation will be put after its completion
handler has run, so we must not drop the reference if it has already
been scheduled to avoid use-after-free.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Diffstat (limited to 'drivers/staging/greybus/operation.c')
| -rw-r--r-- | drivers/staging/greybus/operation.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/greybus/operation.c b/drivers/staging/greybus/operation.c index 3392b425a6c2..7adfa6346288 100644 --- a/drivers/staging/greybus/operation.c +++ b/drivers/staging/greybus/operation.c @@ -846,8 +846,8 @@ void gb_operation_cancel(struct gb_operation *operation, int errno) gb_message_cancel(operation->request); if (operation->response) gb_message_cancel(operation->response); + gb_operation_put(operation); } - gb_operation_put(operation); } EXPORT_SYMBOL_GPL(gb_operation_cancel); |