Messages in this thread | | | Date | Tue, 19 Nov 2013 17:45:13 -0500 | From | Benjamin LaHaise <> | Subject | Re: [PATCH 1/2] aio: prevent double free in ioctx_alloc |
| |
On Tue, Nov 19, 2013 at 05:33:02PM -0500, Sasha Levin wrote: > ioctx_alloc() calls aio_setup_ring() to allocate a ring. If aio_setup_ring() > fails to do so it would call aio_free_ring() before returning, but > ioctx_alloc() would call aio_free_ring() again causing a double free of > the ring. > > This is easily reproducible from userspace.
I've applied this to my aio-next tree at git://git.kvack.org/~bcrl/aio-next.git . Please verify that it applied correctly, as that tree also includes another fix from Kent relating to the percpu reference bits.
-ben -- "Thought is the essence of where you are now."
| |