tree 62388204ca1bbf77f98a48942a8ecee2a97792e0
parent d16f8f0f0212dc76de91b464ad992a975e782813
author Rohith Kollalsi <rkollals@codeaurora.org> 1614611810 +0530
committer Rohith Kollalsi <rkollals@codeaurora.org> 1620198234 +0530

usb: gadget: f_cdev: Fix use after free of port in f_cdev

With the configfs filesystem it’s possible to manipulate kernel
object by creating/deleting folders into /config path. Here port
object is created by a mkdir and leads to allocate this object,
while the rmdir system call leads to free this object.
If one thread does these two operations of creation and deletion
of the folder and one tries to open it, it can lead to a
race condition where port object can be freed by the time
it is used in f_cdev_open leading to use after free error.

Fix this by using embedded struct device and the refcounting
mechanism built-in which increases and decreases refcount upon
creation and deletion of port and port will be freed when
reference count is zero ensuring that "port" object survives
until the last user releases it.

Change-Id: I88701ef161c9f3215631da81c3a8d4c980d12b25
Signed-off-by: Rohith Kollalsi <rkollals@codeaurora.org>