diff options
| author | Gabriel Prostitis <prostitisgabriel@gmail.com> | 2026-06-01 08:44:11 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-10 15:55:31 +0200 |
| commit | a1c33c80e11ecd5c3310a38c4be324095dd85ac5 (patch) | |
| tree | c1b90a4389bba58f9a64f06c8af8552dc040cec5 /tools/perf/scripts/python | |
| parent | 5eb5c72c72fef76cb765ef1669b62b6a3ba1bfc8 (diff) | |
USB: gadget: inode: fix mm lifetime handling
priv stores a pointer to the submitting task's mm_struct,
but does not currently hold a reference to it while async
requests are pending.
This can result in a use-after-free if the task exits before
completion handling finishes.
Take a reference with mmgrab() when queuing the read request
and release it with mmdrop() on request completion.
Reported-by: Gabriel Prostitis <prostitisgabriel@gmail.com>
Signed-off-by: Gabriel Prostitis <prostitisgabriel@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260601-mm-uaf-fix-v2-2-3c942a707bce@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions