Re: [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst

2017-11-09 Thread Felipe Balbi
Greg KH writes: > On Wed, Nov 08, 2017 at 10:13:15AM -0700, Andrew Gabbasov wrote: >> KASAN enabled configuration reports an error >> >> BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ... >> Write of size 8 by task ... >> >> This is observed after "ffs-test" is run and inter

Re: [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst

2017-11-09 Thread Greg KH
On Wed, Nov 08, 2017 at 10:13:15AM -0700, Andrew Gabbasov wrote: > KASAN enabled configuration reports an error > > BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ... > Write of size 8 by task ... > > This is observed after "ffs-test" is run and interrupted. If after that > fu

Re: [PATCH] usb: gadget: f_fs: Fix use-after-free

2016-04-19 Thread Lars-Peter Clausen
On 04/19/2016 05:34 PM, Michal Nazarewicz wrote: > On Thu, Apr 14 2016, Lars-Peter Clausen wrote: >> Calling the ki_complete() callback will free the underlying data structure. >> Make sure that it is no longer accessed beyond that point, otherwise >> undefined behaviour might occur. >> >> Fixes: 2

Re: [PATCH] usb: gadget: f_fs: Fix use-after-free

2016-04-19 Thread Michal Nazarewicz
On Thu, Apr 14 2016, Lars-Peter Clausen wrote: > Calling the ki_complete() callback will free the underlying data structure. > Make sure that it is no longer accessed beyond that point, otherwise > undefined behaviour might occur. > > Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support") > Sig

Re: [PATCH] usb: gadget: f_fs: Fix use-after-free

2016-04-19 Thread Lars-Peter Clausen
On 04/19/2016 05:29 PM, Michal Nazarewicz wrote: > On Thu, Apr 14 2016, Lars-Peter Clausen wrote: >> Calling the ki_complete() callback will free the underlying data structure. >> Make sure that it is no longer accessed beyond that point, otherwise >> undefined behaviour might occur. > > To be hon

Re: [PATCH] usb: gadget: f_fs: Fix use-after-free

2016-04-19 Thread Michal Nazarewicz
On Thu, Apr 14 2016, Lars-Peter Clausen wrote: > Calling the ki_complete() callback will free the underlying data structure. > Make sure that it is no longer accessed beyond that point, otherwise > undefined behaviour might occur. To be honest I have trouble tracking what ki_complete is. Could yo