Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 9d8d2f45 authored by Jack Pham's avatar Jack Pham
Browse files

usb: gadget: qti: Move miscdevice to context structure



The misc device class uses the dev's drvdata field to store a
pointer to the instance of struct miscdevice. However, the USB
QTI driver is overwriting it with its RMNET-specific context
pointer, which leads to invalid access by namely misc_devnode()
when it retrieves an unexpected pointer.

This unexpected pointer was somewhat benign on 32-bit kernels
since the miscdevice.nodename pointer accessed in misc_devnode()
happens to align exactly with the rmnet_ctrl_qti_port.line_state
member which is initially set to 0. However on 64-bit kernels,
pointers occupy 8 bytes instead of 4, such that the nodename
member now overlaps a raw_spinlock magic field and causes the
code to proceed past the NULL pointer check and crash.

Clean up the USB QTI driver by moving the miscdevice and name
instances into the rmnet_ctrl_qti_port structure itself. This
allows the use container_of to retrieve the context in the file
operation callbacks instead of relying on improperly used
dev_set/get_drvdata.

Change-Id: I9351c3d83565c37eb03f160a9003278a51a66c83
Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
parent ce80330c
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment