usb: misc: diag_bridge: Move dev->ifc cleanup to delete function
Since the close function can be called after disconnect, it can
lead to null pointer dereference from dev->ifc since it is being
assigned null in disconnect. Also, there can be a use-after-free
if the interface structure is used after disconnect function has
been called and core has freed the intf.
Fix this by moving the dev->ifc cleanup from disconnect to the
delete function. This will ensure that dev->ifc exists when the
diag core can still queue read/write and call close. Also do a
get and put of interface from probe and delete respectively to
prevent the use-after-free issue. While at it, also mark ENODEV
error to dev->err to prevent further read/write after disconnect.
Change-Id: I1a1fa4440560b0c0b77880fb3f5a37c3c24c7e67
Signed-off-by:
Ajay Agarwal <ajaya@codeaurora.org>
Loading
Please register or sign in to comment