android_kernel_xiaomi_sm8450

xiaomi-sm8450/android_kernel_xiaomi_sm8450

Files

Oliver Neukum 516a1a07f0 USB: fix race leading to a write after kfree in usbfs

this fixes a race between async_completed() and proc_reapurbnonblock().

CPU A                   CPU B

spin_lock(&ps->lock);
list_move_tail(&as->asynclist, &ps->async_completed);
spin_unlock(&ps->lock);

                                if (!(as = async_getcompleted(ps)))
                                        return -EAGAIN;
                                return processcompl(as, (void __user * __user *)arg);

processcompl() calls free_async() which calls kfree(as)

as->status = urb->status;
if (as->signr) {
        sinfo.si_signo = as->signr;
        sinfo.si_errno = as->status;
        sinfo.si_code = SI_ASYNCIO;
        sinfo.si_addr = as->userurb;
        kill_pid_info_as_uid(as->signr, &sinfo, as->pid, as->uid,
                              as->euid, as->secid);
}
snoop(&urb->dev->dev, "urb complete\n");
snoop_urb(urb, as->userurb);

write after kfree

Signed-off-by: Oliver Neukum <oliver@neukum.org>

2009-07-12 15:16:40 -07:00

buffer.c

USB: pass mem_flags to dma_alloc_coherent

2009-04-23 14:15:28 -07:00

config.c

USB: Change names of SuperSpeed ep companion descriptor structs.

2009-06-15 21:44:50 -07:00

devices.c

USB: add missing class descriptions used in usb/devices file

2009-07-12 15:16:39 -07:00

devio.c

USB: fix race leading to a write after kfree in usbfs