firmware_loader: fix use-after-free in firmware_fallback_sysfs

[linux-2.6-microblaze.git] / drivers / base / firmware_loader / firmware.h

diff --git a/drivers/base/firmware_loader/firmware.h b/drivers/base/firmware_loader/firmware.h
index 63bd29f..a3014e9 100644 (file)
--- a/drivers/base/firmware_loader/firmware.h
+++ b/drivers/base/firmware_loader/firmware.h
@@ -117,8 +117,16 @@ static inline void __fw_state_set(struct fw_priv *fw_priv,
 
        WRITE_ONCE(fw_st->status, status);
 
-       if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
+       if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED) {
+#ifdef CONFIG_FW_LOADER_USER_HELPER
+               /*
+                * Doing this here ensures that the fw_priv is deleted from
+                * the pending list in all abort/done paths.
+                */
+               list_del_init(&fw_priv->pending_list);
+#endif
                complete_all(&fw_st->completion);
+       }
 }
 
 static inline void fw_state_aborted(struct fw_priv *fw_priv)