greybus: es1/2: fix use-after-free in completion callback

Browse source

Reset the hcpriv field before returning the message to greybus core in
the OUT-URB completion callback.

This fixes a use-after-free bug when sending responses to incoming
requests as the final reference is then dropped when the message is
returned.

Reported-by: Michael Scott <michael.scott@linaro.org>
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

...

This commit is contained in:

Johan Hovold 2015-09-26 14:37:59 -07:00 • committed by Greg Kroah-Hartman

parent 336dfeaba1

commit 58c85123d9

2 changed files with 8 additions and 8 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

drivers/staging/greybus/es1.c

View file

8

drivers/staging/greybus/es2.c

View file