From: Al Viro <viro@zeniv.linux.org.uk>
Date: Fri, 6 Feb 2015 07:07:45 +0000 (-0500)
Subject: gadgetfs: use-after-free in ->aio_read()
X-Git-Tag: v3.2.69~127
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f872bbe889c7c78edb222854217b02aaf24b4254;p=pandora-kernel.git

gadgetfs: use-after-free in ->aio_read()

commit f01d35a15fa04162a58b95970fc01fa70ec9dacd upstream.

AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if
we are going to access it asynchronously, we'd better get ourselves
a copy - the one on kernel stack of aio_run_iocb() won't be there
anymore.  function/f_fs.c take care of doing that, legacy/inode.c
doesn't...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.2:
 - Adjust filename, context
 - Add kfree(priv->iv) to one additional failure path]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---

Reading git-diff-tree failed