Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Yang, Fei" <fei.yang@intel.com>
To:     Greg KH <gregkh@linuxfoundation.org>
CC:     "balbi@kernel.org" <balbi@kernel.org>,
        "andrzej.p@collabora.com" <andrzej.p@collabora.com>,
        "plr.vincent@gmail.com" <plr.vincent@gmail.com>,
        "Shen, JingX" <jingx.shen@intel.com>,
        "john.stultz@linaro.org" <john.stultz@linaro.org>,
        "linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH v3] usb: gadget: f_fs: don't free buffer prematurely
Thread-Topic: [PATCH v3] usb: gadget: f_fs: don't free buffer prematurely
Thread-Index: AQHU4C1+gBTRGRZXck6FOc9ySCJUE6YXl0MA//+UF+A=
Date:   Fri, 22 Mar 2019 06:12:11 +0000
Message-ID: <02E7334B1630744CBDC55DA8586225837F7FC660@ORSMSX102.amr.corp.intel.com>
References: <1553203874-130203-1-git-send-email-fei.yang@intel.com>
 <20190322053602.GA31708@kroah.com>
In-Reply-To: <20190322053602.GA31708@kroah.com>
Accept-Language: en-US
Content-Language: en-US
dlp-product: dlpe-windows
dlp-version: 11.0.400.15
dlp-reaction: no-action
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 8BIT
MIME-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

>> The following kernel panic happens due to the io_data buffer gets 
>> deallocated before the async io is completed. Add a check for the case 
>> where io_data buffer should be deallocated by ffs_user_copy_worker.
>> 
>> [   41.663334] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
>> 
>> Fixes: 772a7a724f6 ("usb: gadget: f_fs: Allow scatter-gather buffers")
>> Signed-off-by: Fei Yang <fei.yang@intel.com>
>> Reviewed-by: Manu Gautam <mgautam@codeaurora.org>
>> Tested-by: John Stultz <john.stultz@linaro.org>
>> ---
>> v2: add tag: "Fixes: 772a7a724f6 ......", Reviewed-by and Tested-by.
>> v3: check data for NULL instead of "ret == -EIOCBQUEUED", which would be safer
>>     and keep the original logic intact.
> 
> If it "fixes" a problem in 5.0, we should add a:
> 	Cc: stable <stable@vger.kernel.org>
> to it as well.
Sent [PATCH v4] with Cc: stable

> thanks,
> 
> greg k-h