kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Al Viro c81fc59be4 gadgetfs: use-after-free in ->aio_read() 
[ Upstream commit f01d35a15f ]

AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if
we are going to access it asynchronously, we'd better get ourselves
a copy - the one on kernel stack of aio_run_iocb() won't be there
anymore.  function/f_fs.c take care of doing that, legacy/inode.c
doesn't...

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2015-03-28 10:01:39 -04:00
..
function usb: gadget: function: Fixed the return value on error path 2014-10-23 14:49:35 -05:00
legacy gadgetfs: use-after-free in ->aio_read() 2015-03-28 10:01:39 -04:00
udc usb: gadget: udc: atmel: fix possible oops when unloading module 2015-01-27 08:29:43 -08:00
composite.c usb: gadget: composite: enable BESL support 2014-10-23 09:55:41 -05:00
config.c usb: gadget: always update HS/SS descriptors and create a copy of them 2012-10-31 15:09:44 +02:00
configfs.c usb: gadget: configfs: don't NUL-terminate (sub)compatible ids 2015-03-14 15:37:24 -04:00
configfs.h usb: gadget: OS descriptors: provide interface directory names 2014-06-19 10:06:48 -05:00
epautoconf.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00
functions.c usb: gadget: add a forward pointer from usb_function to its "instance" 2013-01-21 20:52:46 +02:00
Kconfig usb: gadget: f_uvc: convert f_uvc to new function interface 2014-09-09 09:49:16 -05:00
Makefile usb: gadget: use $(srctree) instead of $(PWD) for includes 2014-08-29 15:53:46 -05:00
u_f.c usb: gadget: only GPL drivers in the gadget and phy framework 2014-04-21 14:07:12 -05:00
u_f.h usb: gadget: FunctionFS: share VLA macros with all usb gadget files 2014-05-14 09:37:27 -05:00
u_os_desc.h usb: gadget: u_os_desc: helper functions for accessing ext prop buffer 2014-07-10 08:36:51 -05:00
usbstring.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00