Re: [PATCH] usb: gadget: f_fs: Fix use-after-free

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 04/19/2016 05:29 PM, Michal Nazarewicz wrote:
> On Thu, Apr 14 2016, Lars-Peter Clausen wrote:
>> Calling the ki_complete() callback will free the underlying data structure.
>> Make sure that it is no longer accessed beyond that point, otherwise
>> undefined behaviour might occur.
> 
> To be honest I have trouble tracking what ki_complete is.  Could you
> describe the path that leads to the bug in a little more detail?

It's the completion function for AIO requests. So any AIO read or write
request on a EP file descriptor will trigger this.

I can try to rewrite the commit message if you want to.
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux