greybus: operation: fix null-deref on operation destroy
Incoming operations are created without a response message. If a
protocol driver fails to send a response, or if the operation were to be
cancelled before it has been fully processed, we get a null-pointer
dereference when the operation is released.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
diff --git a/drivers/staging/greybus/operation.c b/drivers/staging/greybus/operation.c
index 17f4eab..cb0c87a 100644
--- a/drivers/staging/greybus/operation.c
+++ b/drivers/staging/greybus/operation.c
@@ -607,7 +607,8 @@
list_del(&operation->links);
spin_unlock_irqrestore(&gb_operations_lock, flags);
- gb_operation_message_free(operation->response);
+ if (operation->response)
+ gb_operation_message_free(operation->response);
gb_operation_message_free(operation->request);
kmem_cache_free(gb_operation_cache, operation);