A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 05:39:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

usb: dwc3: Prevent use after free of dwc_ipc_log_ctx

Browse source 
The dbg_event function call in dwc3_msm_remove after the
child dwc3 device is removed is resulting in use after
free of dwc_ipc_log_ctx.
Even though the dwc_ipc_log_ctx is set to NULL in
dwc3_remove, the value is reset once the core platform
device is removed because the dwc3 is allocated using
devm_kzalloc. This call ensures that the memory is freed
up once the device driver is de-registered.
Fix this by calling the dbg_event before de-registering
the core driver.

Change-Id: Ib2cc3d233ea0fd4a1523cae23f57d3cb3753a53f
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
This commit is contained in:
Sriharsha Allenki 2019-04-16 15:33:30 +05:30 • committed by Gerrit - the friendly Code Review server
commit bbbaf52d01
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/usb/dwc3/dwc3-msm.c
View file

@ -4589,10 +4589,10 @@ static int dwc3_msm_remove(struct platform_device *pdev)
if (mdwc->hs_phy)
mdwc->hs_phy->flags &= ~PHY_HOST_MODE;
dbg_event(0xFF, "Remov put", 0);
platform_device_put(mdwc->dwc3);
of_platform_depopulate(&pdev->dev);
dbg_event(0xFF, "Remov put", 0);
pm_runtime_disable(mdwc->dev);
pm_runtime_barrier(mdwc->dev);
pm_runtime_put_sync(mdwc->dev);