ANDROID: usb: f_accessory: Don't corrupt global state on double registration
If acc_setup() is called when there is already an allocated instance, misc_register() will fail but the error path leaves a dangling pointer to freed memory in the global 'acc_dev' state. Fix this by ensuring that the refcount is zero before we start, and then using a cmpxchg() from NULL to serialise any concurrent initialisers. Bug: 173789633 Signed-off-by:Will Deacon <willdeacon@google.com> Change-Id: I2c26289dcce7dbc493964516c49b05d04aaa6839 Signed-off-by:
Giuliano Procida <gprocida@google.com>
Loading
Please register or sign in to comment