Changeset e657635 in mainline

Timestamp:

2016-07-23T13:53:16Z (8 years ago)

Author:

Jakub Jermar <jakub@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

f527f58

Parents:

086f8e3

Message:

Fix use after free in hcd_ddf_remove_device()

The problem here is that victim is victim→fun's private data and
because we are destroying victim→fun, we must be careful not to
touch victim afterwards. We therefore need to save victim→address
aside prior to destroying the function.

File:

• uspace/lib/usbhost/src/ddf_helpers.c (modified) (1 diff)

uspace/lib/usbhost/src/ddf_helpers.c

@@ -446 +446 @@
                 const int ret = ddf_fun_unbind(victim->fun);
                 if (ret == EOK) {
+                        usb_address_t address = victim->address;
                         ddf_fun_destroy(victim->fun);
-                        hcd_release_address(hcd, victim->address);
+                        hcd_release_address(hcd, address);
                 } else {
                         usb_log_warning("Failed to unbind device `%s': %s\n",