Skip to content
Snippets Groups Projects
Commit 5d70d641 authored by Pratham Pratap's avatar Pratham Pratap Committed by Stuart Scott
Browse files

USB: f_qc_rndis: Prevent use-after-free for _rndis_qc


Assume that there are two threads, thread1 is setting
value of _rndis_qc variable in rndis_qc_bind_config_vendor
function. Thread2 jumps in and get the value of _rndis_qc
in rndis_qc_open_dev function before it is freed in
rndis_qc_bind_config_vendor function, since rndis_ipa_init
or usb_add_function failed. Use-after-free will happen as
Thread2 is referencing freed objects. To prevent this
spinlock is used where ever it is needed to protect
_rndis_qc variable.

Bug: 35136547
Change-Id: Ibfe10cedc18bcb19dd01cd2bec43a5554fd008bc
Signed-off-by: default avatarPratham Pratap <prathampratap@codeaurora.org>
parent ada4869e
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment