Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a51e8551 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

greybus: es2: fix use-after-free at disconnect 



The interface private data is released as part of host-device removal
and must not be accessed afterwards.

Signed-off-by: default avatarJohan Hovold <johan@hovoldconsulting.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parent 357499df

drivers/staging/greybus/es2.c

+3 −1
Original line number Diff line number Diff line
@@ -510,6 +510,7 @@ static void ap_disconnect(struct usb_interface *interface) 
{

	struct es2_ap_dev *es2;

	struct usb_device *udev;

	int *cport_to_ep;

	int bulk_in;

	int i;
@@ -548,9 +549,10 @@ static void ap_disconnect(struct usb_interface *interface) 


	usb_set_intfdata(interface, NULL);

	udev = es2->usb_dev;

	cport_to_ep = es2->cport_to_ep;

	gb_hd_remove(es2->hd);

	kfree(es2->cport_to_ep);



	kfree(cport_to_ep);

	usb_put_dev(udev);

}