connection: don't oops if CANCEL_FD doesn't support poll

Verify the passed CANCEL_FD does actually support ->poll(). Otherwise, we
will call a NULL pointer.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>

diff --git a/connection.c b/connection.c
index de4a864dbdcd1382cdb93035eb044d1467b9b517..688d1ba122929de91e1c95b669766b08eb39a017 100644 (file)
--- a/connection.c
+++ b/connection.c
@@ -651,6 +651,10 @@ static int kdbus_conn_wait_reply(struct kdbus_conn *conn_src,
                cancel_fd = fget(cancel_fd_item->fds[0]);
                if (IS_ERR(cancel_fd))
                        return PTR_ERR(cancel_fd);
+               if (!cancel_fd->f_op->poll) {
+                       fput(cancel_fd);
+                       return -EINVAL;
+               }
 
                cancel_fd->f_op->poll(cancel_fd, &pwq.pt);
        }