• Al Viro's avatar
    gadgetfs: use-after-free in ->aio_read() · f01d35a1
    Al Viro authored
    AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if
    we are going to access it asynchronously, we'd better get ourselves
    a copy - the one on kernel stack of aio_run_iocb() won't be there
    anymore.  function/f_fs.c take care of doing that, legacy/inode.c
    doesn't...
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    f01d35a1
inode.c 52.4 KB