From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Date: Fri, 11 Dec 2015 13:46:51 +0000 (+0000)
Subject: greybus: loopback: Retrun -ENOMEM if operation allocation fails
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=c7aae4e613ef471f9f785e4b85de4d46d552c86b;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

greybus: loopback: Retrun -ENOMEM if operation allocation fails

If operation allocation fails we should return -ENOMEM in the asynchronous
operation send routine. If we don't return here then the
gb_loopback_async_operation_put() later can dereference a NULL pointer if
the previous gb_operation_create() failed.

Reported-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---

diff --git a/drivers/staging/greybus/loopback.c b/drivers/staging/greybus/loopback.c
index 0828772fc901..eb6a0138fb1d 100644
--- a/drivers/staging/greybus/loopback.c
+++ b/drivers/staging/greybus/loopback.c
@@ -580,8 +580,8 @@ static int gb_loopback_async_operation(struct gb_loopback *gb, int type,
 	operation = gb_operation_create(gb->connection, type, request_size,
 					response_size, GFP_KERNEL);
 	if (!operation) {
-		ret = -ENOMEM;
-		goto error;
+		kfree(op_async);
+		return -ENOMEM;
 	}
 
 	if (request_size)