g
> Subject: Re: [PATCH v1 Resend] usb: dwc2: gadget: fix a memory use-after-free
> bug
>
> On Thu, Oct 01, 2015 at 12:01:48PM +, Kaukab, Yousaf wrote:
> > > From: Mian Yousaf Kaukab
> > > Date: Tue, Sep 29, 2015 at 12:25 PM
> > > Subject: [PATCH v1 Resend]
On Thu, Oct 01, 2015 at 12:01:48PM +, Kaukab, Yousaf wrote:
> > From: Mian Yousaf Kaukab
> > Date: Tue, Sep 29, 2015 at 12:25 PM
> > Subject: [PATCH v1 Resend] usb: dwc2: gadget: fix a memory use-after-free
> > bug
> > To: linux-...@vger.kernel.org, ba...@
> From: Mian Yousaf Kaukab
> Date: Tue, Sep 29, 2015 at 12:25 PM
> Subject: [PATCH v1 Resend] usb: dwc2: gadget: fix a memory use-after-free bug
> To: linux-...@vger.kernel.org, ba...@ti.com, john.y...@synopsys.com,
> l...@rock-chips.com
> Cc: he...@sntech.de, c...@rock-ch
From: Yunzhi Li
When dwc2_hsotg_handle_unaligned_buf_complete() hs_req->req.buf
already destroyed, in dwc2_hsotg_unmap_dma(), it touches
hs_req->req.dma again, so dwc2_hsotg_unmap_dma() should be called
before dwc2_hsotg_handle_unaligned_buf_complete(). Otherwise, it
will cause a bad_page BUG, wh
4 matches
Mail list logo
