• Al Viro's avatar
    gadgetfs: use-after-free in ->aio_read() · 0b4b4c30
    Al Viro authored
    commit f01d35a1 upstream.
    
    AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if
    we are going to access it asynchronously, we'd better get ourselves
    a copy - the one on kernel stack of aio_run_iocb() won't be there
    anymore.  function/f_fs.c take care of doing that, legacy/inode.c
    doesn't...
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    [lizf: Backproted to 3.4:
     - adjust context
     - need kfree() after calling get_ready_ep()]
    Signed-off-by: default avatarZefan Li <lizefan@huawei.com>
    0b4b4c30
inode.c 52.1 KB