diff options
| author | Johan Hovold <johan@hovoldconsulting.com> | 2015-03-17 10:55:52 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <greg@kroah.com> | 2015-03-17 22:32:58 +0100 |
| commit | 44538397e79987080adc619c6fd4edda92093d46 (patch) | |
| tree | 8eaaf764f716cc39f30010d856d9af6816a91e39 /drivers/staging/greybus/connection.c | |
| parent | deeb57f5bd990f747815216ab772e92413848f6e (diff) | |
| download | linux-stable-44538397e79987080adc619c6fd4edda92093d46.tar.gz linux-stable-44538397e79987080adc619c6fd4edda92093d46.tar.bz2 linux-stable-44538397e79987080adc619c6fd4edda92093d46.zip | |
greybus: connection: fix oops after failed init
Make sure not to call connection_exit for connections that have never
been initialised (e.g. due to failure to init).
This fixes oopses due to null-dereferences and use-after-free in
connection_exit callbacks (e.g. trying to remove a gpio-chip that has
never been added) when the bundle and interface are ultimately
destroyed.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Diffstat (limited to 'drivers/staging/greybus/connection.c')
| -rw-r--r-- | drivers/staging/greybus/connection.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/staging/greybus/connection.c b/drivers/staging/greybus/connection.c index 3ec984c8d7e5..46e259f05a55 100644 --- a/drivers/staging/greybus/connection.c +++ b/drivers/staging/greybus/connection.c @@ -298,6 +298,10 @@ void gb_connection_exit(struct gb_connection *connection) dev_warn(&connection->dev, "exit without protocol.\n"); return; } + + if (connection->state != GB_CONNECTION_STATE_ENABLED) + return; + connection->state = GB_CONNECTION_STATE_DESTROYING; connection->protocol->connection_exit(connection); } |