Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit de84d964 authored by Pratham Pratap's avatar Pratham Pratap Committed by Gerrit - the friendly Code Review server
Browse files

usb: gsi: Set setup_pending if ep_queue on EP0 is successful



Consider a scenario where setup packet gets queued from the
function driver and without geting completion for that request
composition switch or cable disconnect happens. Since the
request is not given back to the gadget driver it will be in
pending list. During composition switch or cable disconnect
composite dev cleanup happens which will free the request
without dequeing it since setup_pending is not set for the
request. When a new setup packet is queued and the completion
for the new setup packet happens driver will try to access the
freed request from the pending list leading to use-after-free.

Fix this by setting setup_pending to true if ep_queue on ep0
is successful.

Change-Id: I7fe083dfc99663681fc0b98e02613799e526d3d4
Signed-off-by: default avatarPratham Pratap <prathampratap@codeaurora.org>
parent 8a7d4fed
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment