Commit e888fa76 authored Dec 20, 2017 by Sai Krishna Juturi

udc: core: Fix use after free issue



In usb_ep_free_request request is freed in gadget driver
and passed to trace_event_usb_ep_free_request, which can
result in invalid memory access.
Fix this by first calling trace_event_usb_ep_free_request
and then free the request

Signed-off-by: Sai Krishna Juturi <jsaikrishna@codeaurora.org>
Change-Id: I3f6e4f02159b0789332818c5f181b1d1586edb17

parent 373476f5

drivers/usb/gadget/udc/core.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -192,8 +192,8 @@ EXPORT_SYMBOL_GPL(usb_ep_alloc_request);
		void usb_ep_free_request(struct usb_ep *ep,
		struct usb_request *req)
		{
		ep->ops->free_request(ep, req);
		trace_usb_ep_free_request(ep, req, 0);
		ep->ops->free_request(ep, req);
		}
		EXPORT_SYMBOL_GPL(usb_ep_free_request);