Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bbbaf52d authored by Sriharsha Allenki's avatar Sriharsha Allenki Committed by Gerrit - the friendly Code Review server
Browse files

usb: dwc3: Prevent use after free of dwc_ipc_log_ctx 



The dbg_event function call in dwc3_msm_remove after the
child dwc3 device is removed is resulting in use after
free of dwc_ipc_log_ctx.
Even though the dwc_ipc_log_ctx is set to NULL in
dwc3_remove, the value is reset once the core platform
device is removed because the dwc3 is allocated using
devm_kzalloc. This call ensures that the memory is freed
up once the device driver is de-registered.
Fix this by calling the dbg_event before de-registering
the core driver.

Change-Id: Ib2cc3d233ea0fd4a1523cae23f57d3cb3753a53f
Signed-off-by: default avatarSriharsha Allenki <sallenki@codeaurora.org>
parent f838988d

drivers/usb/dwc3/dwc3-msm.c

+1 −1
Original line number Diff line number Diff line
@@ -4589,10 +4589,10 @@ static int dwc3_msm_remove(struct platform_device *pdev) 


	if (mdwc->hs_phy)

		mdwc->hs_phy->flags &= ~PHY_HOST_MODE;

	dbg_event(0xFF, "Remov put", 0);

	platform_device_put(mdwc->dwc3);

	of_platform_depopulate(&pdev->dev);



	dbg_event(0xFF, "Remov put", 0);

	pm_runtime_disable(mdwc->dev);

	pm_runtime_barrier(mdwc->dev);

	pm_runtime_put_sync(mdwc->dev);