kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-09-26 18:16:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Lars-Peter Clausen 38740a5b87 usb: gadget: f_fs: Fix use-after-free 
When using asynchronous read or write operations on the USB endpoints the
issuer of the IO request is notified by calling the ki_complete() callback
of the submitted kiocb when the URB has been completed.

Calling this ki_complete() callback will free kiocb. Make sure that the
structure is no longer accessed beyond that point, otherwise undefined
behaviour might occur.

Fixes: 2e4c7553cd ("usb: gadget: f_fs: add aio support")
Cc: <stable@vger.kernel.org> # v3.15+
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
History 2016-04-20 10:38:06 +03:00
..
function usb: gadget: f_fs: Fix use-after-free 2016-04-20 10:38:06 +03:00
legacy mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
udc usb: gadget: udc-core: remove manual dma configuration 2016-04-06 16:36:01 +03:00
composite.c usb: gadget: composite: Clear reserved fields of SSP Dev Cap 2016-04-18 12:35:17 +03:00
config.c usb: gadget: Update function for SuperSpeedPlus 2016-03-04 15:14:23 +02:00
configfs.c Configfs changes for the 4.6 merge window: 2016-03-17 16:25:46 -07:00
configfs.h usb: gadget: OS descriptors: provide interface directory names 2014-06-19 10:06:48 -05:00
epautoconf.c usb: gadget: epautoconf: add usb_ep_autoconfig_release() function 2015-09-27 10:54:31 -05:00
functions.c usb: gadget: add a forward pointer from usb_function to its "instance" 2013-01-21 20:52:46 +02:00
Kconfig Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2016-01-20 17:20:53 -08:00
Makefile usb: gadget: use $(srctree) instead of $(PWD) for includes 2014-08-29 15:53:46 -05:00
u_f.c usb: gadget: define free_ep_req as universal function 2015-12-15 09:12:41 -06:00
u_f.h usb: gadget: define free_ep_req as universal function 2015-12-15 09:12:41 -06:00
u_os_desc.h usb: gadget: u_os_desc: helper functions for accessing ext prop buffer 2014-07-10 08:36:51 -05:00
usbstring.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00