Messages in this thread |  | | Date | Wed, 16 Aug 2017 11:29:06 -0400 (EDT) | From | Alan Stern <> | Subject | Re: [PATCH] udc: Memory leak on error path and use after free |
| |
On Wed, 16 Aug 2017, Anton Vasilyev wrote:
> gadget_release() is responsible for cleanup dev memory. > But if net2280_probe() fails after dev allocation, then > gadget_release() become unregistered and dev memory leaks.
This isn't needed if usb_add_gadget_udc_release() is fixed, right?
> Also net2280_remove() calls usb_del_gadget_udc() which > perform schedule_delayed_work() with gadget_release(), so > it is possible that dev will be deallocated exactly after > this call and leads to use after free.
Where is there a possible use after free?
> The patch moves deallocation from gadget_release() to > net2280_remove().
Alan Stern
|  |