Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2ec1e39 authored by Jack Pham's avatar Jack Pham
Browse files

usb: gadget: qc_rndis: Properly handle rndis_ipa_init failure 



Currently if rndis_ipa_init() fails port->func doesn't get
removed from the configuration list, and will lead to a
use-after-free when the calling function later tries to remove
the function. Fix this to handle the failure gracefully and only
call usb_add_function() if it succeeded.

Change-Id: I2ad0dfeaea6b5b6ba1e47aad564ac052348677e6
Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
parent 179fd82c

drivers/usb/gadget/f_qc_rndis.c

+12 −12
Original line number Diff line number Diff line
@@ -1240,25 +1240,25 @@ rndis_qc_bind_config_vendor(struct usb_configuration *c, u8 ethaddr[ETH_ALEN], 


	_rndis_qc = rndis;



	status = usb_add_function(c, &rndis->port.func);

	if (rndis->xport == USB_GADGET_XPORT_BAM2BAM_IPA) {

		status = rndis_ipa_init(&rndis_ipa_params);

		if (status) {

		kfree(rndis);

			pr_err("%s: failed to init rndis_ipa\n", __func__);

			goto fail;

		}

	}



	if (rndis->xport != USB_GADGET_XPORT_BAM2BAM_IPA)

		return status;



	status = rndis_ipa_init(&rndis_ipa_params);

	status = usb_add_function(c, &rndis->port.func);

	if (status) {

		pr_err("%s: failed to initialize rndis_ipa\n", __func__);

		kfree(rndis);

		if (rndis->xport == USB_GADGET_XPORT_BAM2BAM_IPA)

			rndis_ipa_cleanup(rndis_ipa_params.private);

		goto fail;

	} else {

		pr_debug("%s: rndis_ipa successful created\n", __func__);

		return status;

	}



	return 0;



fail:

	kfree(rndis);

	_rndis_qc = NULL;

	rndis_exit();

	return status;