Fork us on GitHub Follow us on Facebook Follow us on Twitter

Changeset e657635 in mainline


Ignore:
Timestamp:
2016-07-23T13:53:16Z (4 years ago)
Author:
Jakub Jermar <jakub@…>
Branches:
master
Children:
f527f58
Parents:
086f8e3
Message:

Fix use after free in hcd_ddf_remove_device()

The problem here is that victim is victim→fun's private data and
because we are destroying victim→fun, we must be careful not to
touch victim afterwards. We therefore need to save victim→address
aside prior to destroying the function.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • uspace/lib/usbhost/src/ddf_helpers.c

    r086f8e3 re657635  
    446446                const int ret = ddf_fun_unbind(victim->fun);
    447447                if (ret == EOK) {
     448                        usb_address_t address = victim->address;
    448449                        ddf_fun_destroy(victim->fun);
    449                         hcd_release_address(hcd, victim->address);
     450                        hcd_release_address(hcd, address);
    450451                } else {
    451452                        usb_log_warning("Failed to unbind device `%s': %s\n",
Note: See TracChangeset for help on using the changeset viewer.