evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

usb: gadget: f_qc_rndis: Fix double-free in qcrndis_free_inst

Browse source 
qcrndis_free_inst function can double free f_qc_rndis pointer.
Hence fix this memory bug in qcrndis_free_inst function.

Same bool RNDIS flag is used for USB_CONFIGFS_RNDIS and
USB_CONFIGFS_QCRNDIS. Add bool Change in Kconfig to differentiate
these two different configs.

Change-Id: I8e7c4be090107618cd6cbac394a57f109f8a1ced
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
This commit is contained in:
Chandana Kishori Chiluveru 2016-12-15 19:43:30 +05:30
parent 3162449f7d
commit c2e31d922c
2 changed files with 2 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/usb/gadget/Kconfig
View file

@ -325,7 +325,7 @@ config USB_CONFIGFS_ECM_SUBSET
a simple CDC subset is used, placing fewer demands on USB. a simple CDC subset is used, placing fewer demands on USB.
config USB_CONFIGFS_QCRNDIS config USB_CONFIGFS_QCRNDIS
bool "RNDIS" bool "QCRNDIS"
depends on USB_CONFIGFS depends on USB_CONFIGFS
depends on RNDIS_IPA depends on RNDIS_IPA
depends on NET depends on NET

13
drivers/usb/gadget/function/f_qc_rndis.c
View file

@ -1320,19 +1320,16 @@ static struct miscdevice rndis_qc_device = {
static void qcrndis_free_inst(struct usb_function_instance *f) static void qcrndis_free_inst(struct usb_function_instance *f)
{ {
struct f_rndis_qc *rndis;
struct f_rndis_qc_opts *opts = container_of(f, struct f_rndis_qc_opts *opts = container_of(f,
struct f_rndis_qc_opts, func_inst); struct f_rndis_qc_opts, func_inst);
unsigned long flags; unsigned long flags;
rndis = opts->rndis;
misc_deregister(&rndis_qc_device); misc_deregister(&rndis_qc_device);
ipa_data_free(USB_IPA_FUNC_RNDIS); ipa_data_free(USB_IPA_FUNC_RNDIS);
spin_lock_irqsave(&rndis_lock, flags); spin_lock_irqsave(&rndis_lock, flags);
kfree(rndis);
_rndis_qc = NULL;
kfree(opts->rndis); kfree(opts->rndis);
_rndis_qc = NULL;
kfree(opts); kfree(opts);
spin_unlock_irqrestore(&rndis_lock, flags); spin_unlock_irqrestore(&rndis_lock, flags);
} }
@ -1414,13 +1411,6 @@ static struct usb_function_instance *qcrndis_alloc_inst(void)
return &opts->func_inst; return &opts->func_inst;
} }
static void rndis_qc_cleanup(void)
{
pr_info("rndis QC cleanup\n");
misc_deregister(&rndis_qc_device);
}
void *rndis_qc_get_ipa_rx_cb(void) void *rndis_qc_get_ipa_rx_cb(void)
{ {
return rndis_ipa_params.ipa_rx_notify; return rndis_ipa_params.ipa_rx_notify;
@ -1458,7 +1448,6 @@ static int __init usb_qcrndis_init(void)
static void __exit usb_qcrndis_exit(void) static void __exit usb_qcrndis_exit(void)
{ {
usb_function_unregister(&rndis_bamusb_func); usb_function_unregister(&rndis_bamusb_func);
rndis_qc_cleanup();
} }
module_init(usb_qcrndis_init); module_init(usb_qcrndis_init);