kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Lars-Peter Clausen e4c7ab7658 usb: gadget: f_fs: Fix use-after-free 
commit 38740a5b87 upstream.

When using asynchronous read or write operations on the USB endpoints the
issuer of the IO request is notified by calling the ki_complete() callback
of the submitted kiocb when the URB has been completed.

Calling this ki_complete() callback will free kiocb. Make sure that the
structure is no longer accessed beyond that point, otherwise undefined
behaviour might occur.

Fixes: 2e4c7553cd ("usb: gadget: f_fs: add aio support")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2016-05-04 14:48:41 -07:00
..
function usb: gadget: f_fs: Fix use-after-free 2016-05-04 14:48:41 -07:00
legacy Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2015-11-13 20:04:17 -08:00
udc usb: gadget: pxa27x: fix suspend callback 2015-11-19 14:48:35 -06:00
composite.c usb: gadget: composite: fill bcdUSB for any gadget max speed 2015-10-09 16:35:20 -05:00
config.c usb: gadget: add usb otg descriptor allocate and init interface 2015-07-29 09:59:21 -05:00
configfs.c usb-gadget: use per-attribute show and store methods 2015-10-13 22:12:57 -07:00
configfs.h usb: gadget: OS descriptors: provide interface directory names 2014-06-19 10:06:48 -05:00
epautoconf.c usb: gadget: epautoconf: add usb_ep_autoconfig_release() function 2015-09-27 10:54:31 -05:00
functions.c usb: gadget: add a forward pointer from usb_function to its "instance" 2013-01-21 20:52:46 +02:00
Kconfig usb: gadget: mass_storage: allow for deeper queue lengths 2015-09-27 10:54:31 -05:00
Makefile usb: gadget: use $(srctree) instead of $(PWD) for includes 2014-08-29 15:53:46 -05:00
u_f.c usb: gadget: only GPL drivers in the gadget and phy framework 2014-04-21 14:07:12 -05:00
u_f.h usb: gadget: FunctionFS: share VLA macros with all usb gadget files 2014-05-14 09:37:27 -05:00
u_os_desc.h usb: gadget: u_os_desc: helper functions for accessing ext prop buffer 2014-07-10 08:36:51 -05:00
usbstring.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00