Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 246a1a85 authored by Sriharsha Allenki's avatar Sriharsha Allenki
Browse files

usb: gadget: f_fs: Fix use after free issue as part of queue failure



In the case where asynchronous IO is enabled on f_fs,
the request is freed up if the queue to the gadget has failed
but the io_data->req is not cleared.
In the case of this failure the ADB daemon does a aio_cancel
which access this io_data->req to dequeue it, which is
an invalid opertaion and leads to a potential use after free
issue.
Fix this by setting the io_data->req to NULL when the request
if freed as part of queue failure.

Change-Id: I496073789922761b505fb61f9ef551845b068823
Signed-off-by: default avatarSriharsha Allenki <sallenki@codeaurora.org>
parent 75109115
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment