Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 427a8c5d authored by Ajay Agarwal's avatar Ajay Agarwal Committed by Gerrit - the friendly Code Review server
Browse files

usb: misc: diag_bridge: Move dev->ifc cleanup to delete function



Since the close function can be called after disconnect, it can
lead to null pointer dereference from dev->ifc since it is being
assigned null in disconnect. Also, there can be a use-after-free
if the interface structure is used after disconnect function has
been called and core has freed the intf.
Fix this by moving the dev->ifc cleanup from disconnect to the
delete function. This will ensure that dev->ifc exists when the
diag core can still queue read/write and call close. Also do a
get and put of interface from probe and delete respectively to
prevent the use-after-free issue. While at it, also mark ENODEV
error to dev->err to prevent further read/write after disconnect.

Change-Id: I1a1fa4440560b0c0b77880fb3f5a37c3c24c7e67
Signed-off-by: default avatarAjay Agarwal <ajaya@codeaurora.org>
parent 727e7069
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment