greybus: operation: fix broken activation logic
authorJohan Hovold <johan@hovoldconsulting.com>
Wed, 18 May 2016 13:47:48 +0000 (15:47 +0200)
committerGreg Kroah-Hartman <gregkh@google.com>
Wed, 18 May 2016 23:30:52 +0000 (16:30 -0700)
commitef62adae82524c745640850f62ab0dfe0b580c9f
tree4a1b53545933d6653a1fa604c8cb6e5925aa097d
parentb0e97bce153a416c4de4841078fba57b69de10f5
greybus: operation: fix broken activation logic

An operation should only be added to the connection active list if the
connection is in the enabled state, or if it is in the enabled_tx state
and the operation is not incoming.

This fixes a race where an early or late incoming request could be added
to the active list while the connection is being enabled or disabled,
something which could lead to use-after-free issues or worse.

Note that the early connection-state checks in the receive path
limited the impact of this bug.

Fixes: e903a2ce7379 ("connection: add unidirectional enabled state")
Reported-by: Alex Elder <elder@linaro.org>
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
drivers/staging/greybus/operation.c