greybus: legacy: fix a null pointer dereference
authorBartosz Golaszewski <bgolaszewski@baylibre.com>
Wed, 27 Jan 2016 12:17:52 +0000 (13:17 +0100)
committerGreg Kroah-Hartman <gregkh@google.com>
Thu, 28 Jan 2016 01:34:54 +0000 (17:34 -0800)
When gb_protocol_get() fails in legacy_connection_create(), we end up
bailing-out before assigning lc->connection and lc->protocol. Calling
legacy_connection_destroy() in that case results in a null pointer
dereference.

Check if lc->connection is not null before freeing it.

Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Reviewed-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
drivers/staging/greybus/legacy.c

index 4a45a943470d990054f10c6db162aaf880d95888..838c70fe74c0a11d223feb5b6ff6b52bfcc7d327 100644 (file)
@@ -148,6 +148,9 @@ err_protocol_put:
 
 static void legacy_connection_destroy(struct legacy_connection *lc)
 {
+       if (!lc->connection)
+               return;
+
        lc->connection->protocol = NULL;
 
        gb_connection_destroy(lc->connection);