usb: gadget: f_ipc: Fix race between ipc_free_inst and ipc_close
There is a possibility of race condition when we unregister the
gadget f_ipc.As part of this, ipc_free_inst and ipc_close gets
executed in parallel threads. The race condition may arise
depending on when the ipc_dev is freed in ipc_free_inst, which in
turn could lead to use-after-free in ipc_close.
Fix this by moving the allocation and de-allocation of ipc_dev in
ipc_init and ipc_exit.
Change-Id: I30bf28258a8da6d2c9cd2f4eae7f38025b49ee0d
Signed-off-by:
Harsh Agarwal <harshq@codeaurora.org>
Loading
Please register or sign in to comment