projects / openwrt / staging / blogic.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 70e60d9) | patch
gadgetfs: use-after-free in ->aio_read()
authorAl Viro <viro@zeniv.linux.org.uk>
Fri, 6 Feb 2015 07:07:45 +0000 (02:07 -0500)
committerAl Viro <viro@zeniv.linux.org.uk>
Wed, 18 Feb 2015 03:23:32 +0000 (22:23 -0500)
commitf01d35a15fa04162a58b95970fc01fa70ec9dacd
tree4a54918fe9e942e5826d6e4ddfcda6bc979af21etree | snapshot
parent70e60d917e91fff2237095b8950810effa2b1a50commit | diff
gadgetfs: use-after-free in ->aio_read()

AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if
we are going to access it asynchronously, we'd better get ourselves
a copy - the one on kernel stack of aio_run_iocb() won't be there
anymore.  function/f_fs.c take care of doing that, legacy/inode.c
doesn't...

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
drivers/usb/gadget/legacy/inode.c diff | blob | history
John Crispins staging tree