Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 49101f4b authored by Udipto Goswami's avatar Udipto Goswami Committed by Prashanth K
Browse files

usb: gadget: Prevent use after free in qdss connect & close



Dwc3 gadget controller driver can still access usb_request
after dequeue() returns due to async cancellation.
Hence usb_request shouldn't be freed after calling
usb_ep_dequeue() which can otherwise cause use after free.

Fix this by allocating & de-allocating from bind and unbind
instead of data_connection & close.

Currently qdss->gadget is initialised from qdss_set_alt() only,
but alloc_sps_req() uses qdss->gadget which gets called from
qdss_bind(). A potential null pointer dereference can occur
if qdss_bind() gets called before qdss_set_alt(). This is avoided
by duplicating qdss->gadget initialisation from qdss_bind().

Change-Id: I8155ecbebcf762fc87c17841c72c53c6dca2e4a9
Signed-off-by: default avatarUdipto Goswami <ugoswami@codeaurora.org>
parent 34e0fe56
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment