• Al Viro's avatar
    gadgetfs: use-after-free in ->aio_read() · f872bbe8
    Al Viro authored
    commit f01d35a1
    
     upstream.
    
    AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if
    we are going to access it asynchronously, we'd better get ourselves
    a copy - the one on kernel stack of aio_run_iocb() won't be there
    anymore.  function/f_fs.c take care of doing that, legacy/inode.c
    doesn't...
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    [bwh: Backported to 3.2:
     - Adjust filename, context
     - Add kfree(priv->iv) to one additional failure path]
    Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
    f872bbe8
inode.c 52.3 KB