Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit f63d3f0a authored by Sriharsha Allenki's avatar Sriharsha Allenki
Browse files

usb: dwc3: Prevent use after free of dwc_ipc_log_ctx



The dbg_event function call in dwc3_msm_remove after the
child dwc3 device is removed is resulting in use after
free of dwc_ipc_log_ctx which is part of dwc.
Even though the dwc_ipc_log_ctx is set to NULL in
dwc3_remove, the value is reset once the core platform
device is removed because the dwc3 is allocated using
devm_kzalloc. This call ensures that the memory is
freed up once the device driver is de-registered.
This resulted in the invalid use after free of dwc3 resulting
in an invalid value of dwc_ipc_log_ctx.
Fix this by calling the dbg_event before de-registering
the core driver.

Change-Id: Ib2cc3d233ea0fd4a1523cae23f57d3cb3753a53f
Signed-off-by: default avatarSriharsha Allenki <sallenki@codeaurora.org>
parent 766f56fd
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment