Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit e99b1eb7 authored by Pratham Pratap's avatar Pratham Pratap
Browse files

usb: dwc3: Flush bh work before disabling dwc3_irq



Consider a case of quick pull-up disable after pull-up is enabled.
If a SETUP packet comes after bus reset event followed by connection
done event, there is a possibility of race between
composite_dev_cleanup() freeing cdev->req called from
configfs_composite_unbind() and composite_setup() storing req pointer
to stack. This causes use after free of cdev->req. To fix this flush
the bottom half work if there was any work pending before disabling
dwc3_irq.

Change-Id:I309f2117325c500f31e93925ac0a7b0d61ccc078
Signed-off-by: default avatarPratham Pratap <prathampratap@codeaurora.org>
parent 4c16f4bd
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment