USB: f_fs: Fix null pointer access in epfile_io
In the current design, ffs_epfile_io routine relies on ffs_ep->ep
which is never cleared and ffs_ep could be freed on unbind on
disconnect during active IO. There is a race between func->disable
which will run from interrupt context and ffs_epfile_io from the
process context. In this scenario it is trying to access the freed
endpoint descriptor in epfile_io which is freed just before the point
of access during func->unbind. This is leading to null pointer dereference
doing epfile I/O.
Fix this by adding spinlock protection there and also checking stored
ffs_ep context against latest epfile->ep to figure out if endpoint got
disabled or changed before acquiring spin_lock.
Change-Id: Id0b3a1d0af8cd76f524e054461269e6326deb3ac
Signed-off-by:
ChandanaKishori Chiluveru <cchilu@codeaurora.org>
Loading
Please register or sign in to comment