Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 7668c04c authored by Pratham Pratap's avatar Pratham Pratap
Browse files

usb: dwc3: gadget: Avoid use-after-free of stale requests



There is a possibility where cable disconnect can race with
composition switch. In this race if ep0 is stuck in DATA phase the
request queued couldn't be dequeued since USB went into LPM. This request
should have been given back by the gadget driver during ep0 disable but
ep0 disable was never called because of the failure of ep0 transition to
SETUP phase during pullup disable. This request which is still in the
pending list got freed by the composite device. This is leading to
use-after-free upon next connect. Avoid this by not bailing out if
timeout happened while waiting for SETUP phase and continue to
stop USB controller.

Change-Id: Ia76d491f758a058ef81aa1167cac53e5c3fd7808
Signed-off-by: default avatarPratham Pratap <prathampratap@codeaurora.org>
parent 5ddc46af
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment