usb: gadget: f_fs: Fix use after free issue as part of queue failure
In the case where asynchronous IO is enabled on f_fs,
the request is freed up if the queue to the gadget has failed
but the io_data->req is not cleared.
In the case of this failure the ADB daemon does a aio_cancel
which access this io_data->req to dequeue it, which is
an invalid opertaion and leads to a potential use after free
issue.
Fix this by setting the io_data->req to NULL when the request
if freed as part of queue failure.
Change-Id: I496073789922761b505fb61f9ef551845b068823
Signed-off-by:
Sriharsha Allenki <sallenki@codeaurora.org>
Loading
Please register or sign in to comment