| From | Greg Kroah-Hartman <> | Subject | [PATCH 4.14 057/165] usb: gadget: core: Fix use-after-free of usb_request | Date | Thu, 24 May 2018 11:37:43 +0200 |
| |
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manu Gautam <mgautam@codeaurora.org>
[ Upstream commit e74bd4d358e5455233f1dcc3975425905b270b91 ]
Driver is tracing usb_request after freeing it. Fix it by changing the order.
Signed-off-by: Manu Gautam <mgautam@codeaurora.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/usb/gadget/udc/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -191,8 +191,8 @@ EXPORT_SYMBOL_GPL(usb_ep_alloc_request); void usb_ep_free_request(struct usb_ep *ep, struct usb_request *req) { - ep->ops->free_request(ep, req); trace_usb_ep_free_request(ep, req, 0); + ep->ops->free_request(ep, req); } EXPORT_SYMBOL_GPL(usb_ep_free_request);
|