diff options
| author | Hemant Kumar <hemantk@codeaurora.org> | 2016-07-28 12:00:36 -0700 |
|---|---|---|
| committer | Hemant Kumar <hemantk@codeaurora.org> | 2016-07-29 11:46:23 -0700 |
| commit | d5ccebfe354149e263b380c2958aa452a80c3ef9 (patch) | |
| tree | fbbee7fb417635eca049f6a593cbacbdf2626c8e /kernel/sysctl_binary.c | |
| parent | 956d9b1ab3db6c7fef95964f7f6be8860433b74e (diff) | |
usb: gadget: f_cdev: Fix NULL ptr dereference in usb_cser_notify
Upon usb disconnect or composition switch notify ep request buffer
as well as the request are freed. This is racing with user space
ioctl on character device trying to send the notification to USB
host. As a result notify ep request buffer is being dereferenced
causing NULL pointer dereference. Fix the issue by checking
is_connected flag by taking port lock before accessing notify
ep request and request buffer.
Change-Id: I380efdf90305a65d4cde46dfe44762ac11c87678
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Diffstat (limited to 'kernel/sysctl_binary.c')
0 files changed, 0 insertions, 0 deletions