diff options
| author | Sriharsha Allenki <[email protected]> | 2020-03-26 17:26:20 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2020-03-26 15:05:44 +0100 |
| commit | f63ec55ff904b2f2e126884fcad93175f16ab4bb (patch) | |
| tree | 1d5a9d55811345b7d73494201d63234cefd7001e /tools/perf/util/trace-event-scripting.c | |
| parent | 6e562742a052c93d33c52c2e1e6a24a34d2bf3b1 (diff) | |
usb: gadget: f_fs: Fix use after free issue as part of queue failure
In AIO case, the request is freed up if ep_queue fails.
However, io_data->req still has the reference to this freed
request. In the case of this failure if there is aio_cancel
call on this io_data it will lead to an invalid dequeue
operation and a potential use after free issue.
Fix this by setting the io_data->req to NULL when the request
is freed as part of queue failure.
Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
Signed-off-by: Sriharsha Allenki <[email protected]>
CC: stable <[email protected]>
Reviewed-by: Peter Chen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'tools/perf/util/trace-event-scripting.c')
0 files changed, 0 insertions, 0 deletions