Lars-Peter Clausen 38740a5b87 usb: gadget: f_fs: Fix use-after-free ... When using asynchronous read or write operations on the USB endpoints the issuer of the IO request is notified by calling the ki_complete() callback of the submitted kiocb when the URB has been completed. Calling this ki_complete() callback will free kiocb. Make sure that the structure is no longer accessed beyond that point, otherwise undefined behaviour might occur. Fixes: 2e4c7553cd ("usb: gadget: f_fs: add aio support") Cc: <stable@vger.kernel.org> # v3.15+ Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>		2016-04-20 10:38:06 +03:00
..
f_acm.c	usb: gadget: f_acm: Fix configfs attr name	2016-03-04 15:14:50 +02:00
f_ecm.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_eem.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_fs.c	usb: gadget: f_fs: Fix use-after-free	2016-04-20 10:38:06 +03:00
f_hid.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_loopback.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_mass_storage.c	Configfs changes for the 4.6 merge window:	2016-03-17 16:25:46 -07:00
f_mass_storage.h
f_midi.c	usb: gadget: f_midi: unlock on error	2016-04-04 15:18:37 +03:00
f_ncm.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_obex.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_phonet.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_printer.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_rndis.c	Configfs changes for the 4.6 merge window:	2016-03-17 16:25:46 -07:00
f_serial.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_sourcesink.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_subset.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_tcm.c	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending	2016-03-22 12:41:14 -07:00
f_uac1.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_uac2.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_uvc.c	usb: gadget: f_uvc: eliminate abuse of ep->driver data	2015-09-27 10:54:31 -05:00
f_uvc.h
g_zero.h	usb: gadget: define free_ep_req as universal function	2015-12-15 09:12:41 -06:00
Makefile	usb: gadget: f_tcm: convert to new function interface with backward compatibility	2015-12-20 19:40:34 -08:00
ndis.h
rndis.c	usb: gadget: rndis: fix itnull.cocci warnings	2016-02-03 13:36:04 -08:00
rndis.h
storage_common.c
storage_common.h
tcm.h	usb-gadget/tcm: Conversion to percpu_ida tag pre-allocation	2016-03-10 21:48:14 -08:00
u_ecm.h
u_eem.h
u_ether_configfs.h	usb-gadget/ether: use per-attribute show and store methods	2015-10-13 22:14:18 -07:00
u_ether.c	usb: gadget: ether: Allow changing the MTU	2015-12-16 10:07:30 -06:00
u_ether.h
u_fs.h
u_gether.h
u_hid.h
u_midi.h
u_ncm.h
u_phonet.h
u_printer.h
u_rndis.h
u_serial.c	usb: gadget: Add the console support for usb-to-serial port	2015-12-22 11:49:39 -06:00
u_serial.h
u_tcm.h	usb: gadget: f_tcm: convert to new function interface with backward compatibility	2015-12-20 19:40:34 -08:00
u_uac1.c
u_uac1.h
u_uac2.h
u_uvc.h
uvc_configfs.c	configfs: switch ->default groups to a linked list	2016-03-06 16:11:24 +01:00
uvc_configfs.h
uvc_queue.c	[media] media: videobuf2: Move timestamp to vb2_buffer	2015-12-18 13:53:31 -02:00
uvc_queue.h	[media] media: videobuf2: Restructure vb2_buffer	2015-10-01 09:04:43 -03:00
uvc_v4l2.c
uvc_v4l2.h
uvc_video.c
uvc_video.h
uvc.h