usb: dwc3: Flush bh work before disabling dwc3_irq
Consider a case of quick pull-up disable after pull-up is enabled.
If a SETUP packet comes after bus reset event followed by connection
done event, there is a possibility of race between
composite_dev_cleanup() freeing cdev->req called from
configfs_composite_unbind() and composite_setup() storing req pointer
to stack. This causes use after free of cdev->req. To fix this
flush the bottom half work if there was any work pending before
disabling dwc3_irq.
Change-Id: I309f2117325c500f31e93925ac0a7b0d61ccc078
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>
1 file changed