Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 290cc1d5 authored by Pratham Pratap's avatar Pratham Pratap Committed by Ajay Agarwal
Browse files

usb: dwc3: Flush bh work before disabling dwc3_irq



Consider a case of quick pull-up disable after pull-up is enabled.
If a SETUP packet comes after bus reset event followed by connection
done event, there is a possibility of race between
composite_dev_cleanup() freeing cdev->req called from
configfs_composite_unbind() and composite_setup() storing req pointer
to stack. This causes use after free of cdev->req. To fix this
flush the bottom half work if there was any work pending before
disabling dwc3_irq.

Change-Id: I309f2117325c500f31e93925ac0a7b0d61ccc078
Signed-off-by: default avatarPratham Pratap <prathampratap@codeaurora.org>
parent c603b06d
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment