Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d7f1611 authored by Manu Gautam's avatar Manu Gautam
Browse files

usb: android: Fix crash during audio unbind 



As part of composition switch usb_remove_config
is called which takes care of calling func_unbind
of all functions present in that config. It also
calls android_unbind_config which results in calling
audio func_unbind again due to usb_remove_function
call. As android_remove_config takes care of removing
or unbinding functions as well, functions in android.c
don't need to call usb_remove_function which can cause
memory/list corruption.

Change-Id: Iced43efe4bbee44039f8994e5c8f2eb4484c0e54
Signed-off-by: default avatarManu Gautam <mgautam@codeaurora.org>
parent 5589954d

drivers/usb/gadget/android.c

+0 −9
Original line number Original line Diff line number Diff line
@@ -1455,20 +1455,11 @@ static int audio_function_bind_config(struct android_usb_function *f, 
	return usb_add_function(c, config->func);

	return usb_add_function(c, config->func);

}

}





static void audio_function_unbind_config(struct android_usb_function *f,

					  struct usb_configuration *c)

{

	struct audio_function_config *config = f->config;

	if (config->func)

		usb_remove_function(c, config->func);

}



static struct android_usb_function audio_function = {

static struct android_usb_function audio_function = {

	.name		= "audio",

	.name		= "audio",

	.init		= audio_function_init,

	.init		= audio_function_init,

	.cleanup	= audio_function_cleanup,

	.cleanup	= audio_function_cleanup,

	.bind_config	= audio_function_bind_config,

	.bind_config	= audio_function_bind_config,

	.unbind_config	= audio_function_unbind_config,

};

};

#endif

#endif