diff options
| author | Gabriel Prostitis <prostitisgabriel@gmail.com> | 2026-06-01 08:44:10 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-10 15:55:31 +0200 |
| commit | 5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8 (patch) | |
| tree | 96a91a7d1417ad99cbf4efec47366dc9363fa4fe /tools/perf/scripts/python/stackcollapse.py | |
| parent | 3a1c90aeb96a2ecd6c60fcb70437ea1e851a5692 (diff) | |
USB: gadget: ffs: fix mm lifetime handling
io_data stores a pointer to the submitting task's mm_struct,
but does not currently hold a reference to it while async
requests are pending.
This can result in a use-after-free if the task exits before
completion handling finishes.
Take a reference with mmgrab() when queuing the read request
and release it with mmdrop() on request completion.
Reported-by: Gabriel Prostitis <prostitisgabriel@gmail.com>
Signed-off-by: Gabriel Prostitis <prostitisgabriel@gmail.com>
Link: https://patch.msgid.link/20260601-mm-uaf-fix-v2-1-3c942a707bce@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions