lkml.org 
[lkml]   [2013]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 1/2] aio: prevent double free in ioctx_alloc
On Tue, Nov 19, 2013 at 05:33:02PM -0500, Sasha Levin wrote:
> ioctx_alloc() calls aio_setup_ring() to allocate a ring. If aio_setup_ring()
> fails to do so it would call aio_free_ring() before returning, but
> ioctx_alloc() would call aio_free_ring() again causing a double free of
> the ring.
>
> This is easily reproducible from userspace.

I've applied this to my aio-next tree at git://git.kvack.org/~bcrl/aio-next.git
. Please verify that it applied correctly, as that tree also includes
another fix from Kent relating to the percpu reference bits.

-ben
--
"Thought is the essence of where you are now."


\
 
 \ /
  Last update: 2013-11-20 00:21    [W:0.087 / U:0.388 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site