diff options
| author | Christian Lamparter <[email protected]> | 2009-01-20 00:27:57 +0100 |
|---|---|---|
| committer | John W. Linville <[email protected]> | 2009-01-22 13:55:02 -0500 |
| commit | e2fe154e918276e900067a9d1d3a6a963faee041 (patch) | |
| tree | 22936f2b3784c4d89c4f1e2263b528167f42e683 /fs/jbd2/commit.c | |
| parent | 12da401e0d616f738c8b8a368d1f63f365cc78e4 (diff) | |
p54usb: fix nasty use after free
In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <[email protected]> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.
Thanks to Artur Skawina <[email protected]> for reporting and debugging this issue.
Signed-off-by: Christian Lamparter <[email protected]>
Tested-by: Artur Skawina <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Diffstat (limited to 'fs/jbd2/commit.c')
0 files changed, 0 insertions, 0 deletions