diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2015-02-06 02:07:45 -0500 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2015-02-17 22:23:32 -0500 |
| commit | f01d35a15fa04162a58b95970fc01fa70ec9dacd (patch) | |
| tree | 4a54918fe9e942e5826d6e4ddfcda6bc979af21e /drivers/usb/early | |
| parent | 70e60d917e91fff2237095b8950810effa2b1a50 (diff) | |
| download | linux-f01d35a15fa04162a58b95970fc01fa70ec9dacd.tar.gz linux-f01d35a15fa04162a58b95970fc01fa70ec9dacd.tar.bz2 linux-f01d35a15fa04162a58b95970fc01fa70ec9dacd.zip | |
gadgetfs: use-after-free in ->aio_read()
AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if
we are going to access it asynchronously, we'd better get ourselves
a copy - the one on kernel stack of aio_run_iocb() won't be there
anymore. function/f_fs.c take care of doing that, legacy/inode.c
doesn't...
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'drivers/usb/early')
0 files changed, 0 insertions, 0 deletions