lkml.org 
[lkml]   [2013]   [Jan]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 1/3] aio: Fix a null pointer deref in batch_complete_aio
From
On Fri, Jan 25, 2013 at 5:43 AM, Kent Overstreet <koverstreet@google.com> wrote:
> The batch completion code was trying to be a bit too clever, and skip
> checking ctx where it couldn't be NULL - but that broke if a kiocb had
> been cancelled. Move the check to kioctx_ring_unlock().
>
> Reported-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
> Signed-off-by: Kent Overstreet <koverstreet@google.com>
> ---

Acked-by: Hillf Danton <dhillf@gmail.com>

> fs/aio.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/fs/aio.c b/fs/aio.c
> index 62573d3..0d2f39d 100644
> --- a/fs/aio.c
> +++ b/fs/aio.c
> @@ -683,6 +683,9 @@ static inline void kioctx_ring_unlock(struct kioctx *ctx, unsigned tail)
> {
> struct aio_ring *ring;
>
> + if (!ctx)
> + return;
> +
> smp_wmb();
> /* make event visible before updating tail */
>
> @@ -760,8 +763,7 @@ void batch_complete_aio(struct batch_complete *batch)
> }
>
> if (unlikely(req->ki_ctx != ctx)) {
> - if (ctx)
> - kioctx_ring_unlock(ctx, tail);
> + kioctx_ring_unlock(ctx, tail);
>
> ctx = req->ki_ctx;
> tail = kioctx_ring_lock(ctx);
> --
> 1.7.12
>


\
 
 \ /
  Last update: 2013-01-25 15:01    [W:0.127 / U:1.188 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site