Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0b6102e6 authored by Pratham Pratap's avatar Pratham Pratap
Browse files

usb: gadget: serial: Prevent use-after-free 



This change prevents use-after-free of dwc3_requests
during power on/off with USB connected. Since checking
of port->usb means that by that time gserial_disconnect
must have been called and as a part of disconnect we will
free the request pool.

Change-Id: Iee55d9e580e45daaf84e69d89390a3d91b185a80
Signed-off-by: default avatarPratham Pratap <prathampratap@codeaurora.org>
parent 6214ba0f

drivers/usb/gadget/function/u_serial.c

+2 −3
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ 
 * Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)

 * Copyright (C) 2008 David Brownell

 * Copyright (C) 2008 by Nokia Corporation

 * Copyright (c) 2013-2015, 2017 The Linux Foundation. All rights reserved.

 * Copyright (c) 2013-2015, 2017-2018 The Linux Foundation. All rights reserved.

 *

 * This code also borrows from usbserial.c, which is

 * Copyright (C) 1999 - 2002 Greg Kroah-Hartman (greg@kroah.com)
@@ -517,11 +517,10 @@ __acquires(&port->port_lock) 
		/*

		 * If port_usb is NULL, gserial disconnect is called

		 * while the spinlock is dropped and all requests are

		 * freed. Free the current request here.

		 * freed.

		 */

		if (!port->port_usb) {

			started = 0;

			gs_free_req(out, req);

			break;

		}

		if (status) {