Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1754449AbcCJGX0 (ORCPT <rfc822;w@1wt.eu>);
	Thu, 10 Mar 2016 01:23:26 -0500
Received: from mail.linux-iscsi.org ([67.23.28.174]:50438 "EHLO
	linux-iscsi.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751571AbcCJGXR (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Thu, 10 Mar 2016 01:23:17 -0500
Message-ID: <1457590994.4062.59.camel@haakon3.risingtidesystems.com>
Subject: Re: [patch -target tree] usb: gadget: f_tcm: use after free
From: "Nicholas A. Bellinger" <nab@linux-iscsi.org>
To: Felipe Balbi <felipe.balbi@linux.intel.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>, Christoph Hellwig <hch@lst.de>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
        Andrzej Pietrasiewicz <andrzej.p@samsung.com>,
        Bart Van Assche <bart.vanassche@sandisk.com>,
        linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
        target-devel@vger.kernel.org
Date: Wed, 09 Mar 2016 22:23:14 -0800
In-Reply-To: <8737rzg9u7.fsf@intel.com>
References: <20160302100848.GC5533@mwanda> <87k2ll856m.fsf@ti.com>
	 <1457162818.19657.282.camel@haakon3.risingtidesystems.com>
	 <8737rzg9u7.fsf@intel.com>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.4.4-1 
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 1200
Lines: 35

On Wed, 2016-03-09 at 13:38 +0200, Felipe Balbi wrote:
> Hi,
> 
> "Nicholas A. Bellinger" <nab@linux-iscsi.org> writes:
> > [ text/plain ]
> > Hi Felipe + usb-gadget folks,
> >
> > On Wed, 2016-03-02 at 13:55 +0200, Felipe Balbi wrote:
> >> Dan Carpenter <dan.carpenter@oracle.com> writes:
> >> > We need to move the kfree() down a line so we don't dereference a freed
> >> > variable.
> >> >
> >> > Fixes: 1b418a8fcbc0 ('target: Convert demo-mode only drivers to target_alloc_session')
> >> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> >> 
> >> It's okay to take this via target:
> >> 
> >> Signed-off-by: Felipe Balbi <balbi@kernel.org>
> >> 
> >
> > Note this specific patch is only a mechanical change, and we still need
> > reviews for the more interesting conversions:
> >
> > usb-gadget/tcm: Conversion to percpu_ida tag pre-allocation
> > http://www.spinics.net/lists/target-devel/msg11777.html
> >
> > usb-gadget/tcm: Convert to TARGET_SCF_ACK_KREF I/O krefs
> > http://www.spinics.net/lists/target-devel/msg11782.html
> >
> I don't have either patch in my inbox apparently. Care to resend ?
> 
> sorry
> 

A -v4 is going on this week, and will make sure they hit your inbox.