usb: gadget: Move allocation of request from set_alt to bind
Currently allocation of usb requests is done in set_alt. If for some
reason set_alt fails then driver frees the request in the error handling
path. Now since set_alt got failed function_disable gets called from
composite driver which tries to free the same request again. This causes
use-after-free of usb request. This change moves allocaton of request to
bind and freeing of request to unbind function to avoid use-after-free.
Change-Id: I1da695f6cb60bbca684175ce1af37eb16aea1c0b
Signed-off-by:
Pratham Pratap <prathampratap@codeaurora.org>
Loading
Please register or sign in to comment