usb: gsi: Set setup_pending if ep_queue on EP0 is successful
Consider a scenario where setup packet gets queued from the
function driver and without geting completion for that request
composition switch or cable disconnect happens. Since the
request is not given back to the gadget driver it will be in
pending list. During composition switch or cable disconnect
composite dev cleanup happens which will free the request
without dequeing it since setup_pending is not set for the
request. When a new setup packet is queued and the completion
for the new setup packet happens driver will try to access the
freed request from the pending list leading to use-after-free.
Fix this by setting setup_pending to true if ep_queue on ep0
is successful.
Change-Id: I7fe083dfc99663681fc0b98e02613799e526d3d4
Signed-off-by:
Pratham Pratap <prathampratap@codeaurora.org>
Loading
Please register or sign in to comment