Lars-Peter Clausen 38740a5b87 usb: gadget: f_fs: Fix use-after-free ... When using asynchronous read or write operations on the USB endpoints the issuer of the IO request is notified by calling the ki_complete() callback of the submitted kiocb when the URB has been completed. Calling this ki_complete() callback will free kiocb. Make sure that the structure is no longer accessed beyond that point, otherwise undefined behaviour might occur. Fixes: 2e4c7553cd ("usb: gadget: f_fs: add aio support") Cc: <stable@vger.kernel.org> # v3.15+ Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>		2016-04-20 10:38:06 +03:00
..
function	usb: gadget: f_fs: Fix use-after-free	2016-04-20 10:38:06 +03:00
legacy	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
udc	usb: gadget: udc-core: remove manual dma configuration	2016-04-06 16:36:01 +03:00
composite.c	usb: gadget: composite: Clear reserved fields of SSP Dev Cap	2016-04-18 12:35:17 +03:00
config.c	usb: gadget: Update function for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
configfs.c	Configfs changes for the 4.6 merge window:	2016-03-17 16:25:46 -07:00
configfs.h
epautoconf.c	usb: gadget: epautoconf: add usb_ep_autoconfig_release() function	2015-09-27 10:54:31 -05:00
functions.c
Kconfig	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending	2016-01-20 17:20:53 -08:00
Makefile
u_f.c	usb: gadget: define free_ep_req as universal function	2015-12-15 09:12:41 -06:00
u_f.h	usb: gadget: define free_ep_req as universal function	2015-12-15 09:12:41 -06:00
u_os_desc.h
usbstring.c