Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 64287585 authored by Ajay Agarwal's avatar Ajay Agarwal
Browse files

usb: misc: diag_ipc_bridge: Move dev cleanup to delete function



Currently the driver does the diag_briddge_dev's members' cleanup
in disconnect function. This can lead to race between read/write
and disconnect functions where the read/write mutex is being
destroyed when it is in locked state. Also, the read/write
function can be called after disconnect leading to mutex_lock
warning on a destroyed mutex. Finally, since the close function
can be called after disconnect, it can lead to null pointer
dereference from dev->ifc since it is being assigned null in
disconnect. Also, there can be a use-after-free if the interface
structure is used after disconnect function has been called and
core has freed the intf.
Fix this by moving the dev member cleanup from disconnect to the
delete function. This will ensure that mutex and dev->ifc exists
when the diag core can still queue read/write and call close.
Also do a get and put of interface from probe and delete
respectively to prevent the use-after-free issue.

Change-Id: I1a1fa4440560b0c0b77880fb3f5a37c3c24c7e67
Signed-off-by: default avatarAjay Agarwal <ajaya@codeaurora.org>
parent a3073dde
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment