Oliver Neukum
516a1a07f0
USB: fix race leading to a write after kfree in usbfs
this fixes a race between async_completed() and proc_reapurbnonblock().
CPU A CPU B
spin_lock(&ps->lock);
list_move_tail(&as->asynclist, &ps->async_completed);
spin_unlock(&ps->lock);
if (!(as = async_getcompleted(ps)))
return -EAGAIN;
return processcompl(as, (void __user * __user *)arg);
processcompl() calls free_async() which calls kfree(as)
as->status = urb->status;
if (as->signr) {
sinfo.si_signo = as->signr;
sinfo.si_errno = as->status;
sinfo.si_code = SI_ASYNCIO;
sinfo.si_addr = as->userurb;
kill_pid_info_as_uid(as->signr, &sinfo, as->pid, as->uid,
as->euid, as->secid);
}
snoop(&urb->dev->dev, "urb complete\n");
snoop_urb(urb, as->userurb);
write after kfree
Signed-off-by: Oliver Neukum <oliver@neukum.org>
2009-07-12 15:16:40 -07:00
..
2009-06-26 00:23:42 -04:00
2009-07-05 22:39:08 +01:00
2009-06-23 01:54:30 -04:00
2009-07-08 09:35:22 -07:00
2009-07-10 19:12:24 -07:00
2009-07-08 10:30:03 -07:00
2009-06-24 21:08:11 +09:00
2009-07-08 19:04:23 -04:00
2009-06-24 18:34:40 +01:00
2009-06-30 18:55:59 -07:00
2009-07-06 14:03:44 -07:00
2009-07-03 15:45:29 +01:00
2009-07-10 14:11:06 -07:00
2009-07-08 10:30:03 -07:00
2009-07-06 12:39:27 -07:00
2009-07-06 14:03:44 -07:00
2009-06-23 10:38:47 -07:00
2009-07-08 09:32:41 -07:00
2009-07-02 13:16:46 -07:00
2009-07-03 15:45:29 +01:00
2009-06-30 18:55:58 -07:00
2009-06-26 14:37:25 +10:00
2009-07-10 20:31:53 +02:00
2009-07-05 19:21:49 -03:00
2009-06-22 08:54:14 -05:00
2009-07-08 09:32:41 -07:00
2009-07-08 10:30:03 -07:00
2009-06-30 18:56:00 -07:00
2009-07-08 10:15:41 +03:00
2009-07-09 20:33:18 -07:00
2009-07-10 12:35:36 +02:00
2009-07-08 10:30:03 -07:00
2009-06-30 18:55:59 -07:00
2009-07-08 09:35:10 -07:00
2009-07-08 10:30:03 -07:00
2009-07-09 20:33:18 -07:00
Merge branches 'acerhdf', 'acpi-pci-bind', 'bjorn-pci-root', 'bugzilla-12904', 'bugzilla-13121', 'bugzilla-13396', 'bugzilla-13533', 'bugzilla-13612', 'c3_lock', 'hid-cleanups', 'misc-2.6.31', 'pdc-leak-fix', 'pnpacpi', 'power_nocheck', 'thinkpad_acpi', 'video' and 'wmi' into release
2009-06-24 01:19:50 -04:00
2009-07-06 13:57:03 -07:00
2009-07-07 16:37:53 +02:00
2009-07-10 20:31:53 +02:00
2009-07-08 10:30:03 -07:00
2009-06-30 18:56:00 -07:00
2009-07-09 20:33:18 -07:00
2009-06-24 18:34:41 +01:00
2009-07-12 15:16:40 -07:00
2009-07-09 20:44:44 -07:00
2009-07-06 13:57:03 -07:00
2009-06-24 14:35:57 -07:00
2009-07-09 18:29:45 +00:00
2009-07-01 11:19:47 +02:00