On Wed, 16 Aug 2017, Anton Vasilyev wrote: > gadget_release() is responsible for cleanup dev memory. > But if net2280_probe() fails after dev allocation, then > gadget_release() become unregistered and dev memory leaks. This isn't needed if usb_add_gadget_udc_release() is fixed, right? > Also net2280_remove() calls usb_del_gadget_udc() which > perform schedule_delayed_work() with gadget_release(), so > it is possible that dev will be deallocated exactly after > this call and leads to use after free. Where is there a possible use after free? > The patch moves deallocation from gadget_release() to > net2280_remove(). Alan Stern -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
