lkml.org 
[lkml]   [2013]   [Mar]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 095/153] fs: Fix possible use-after-free with AIO
    3.2-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jan Kara <jack@suse.cz>

    commit 54c807e71d5ac59dee56c685f2b66e27cd54c475 upstream.

    Running AIO is pinning inode in memory using file reference. Once AIO
    is completed using aio_complete(), file reference is put and inode can
    be freed from memory. So we have to be sure that calling aio_complete()
    is the last thing we do with the inode.

    CC: Christoph Hellwig <hch@infradead.org>
    CC: Jens Axboe <axboe@kernel.dk>
    CC: Jeff Moyer <jmoyer@redhat.com>
    Acked-by: Jeff Moyer <jmoyer@redhat.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/direct-io.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/direct-io.c
    +++ b/fs/direct-io.c
    @@ -304,9 +304,9 @@ static ssize_t dio_complete(struct dio *
    dio->end_io(dio->iocb, offset, transferred,
    dio->private, ret, is_async);
    } else {
    + inode_dio_done(dio->inode);
    if (is_async)
    aio_complete(dio->iocb, ret, 0);
    - inode_dio_done(dio->inode);
    }

    return ret;



    \
     
     \ /
      Last update: 2013-03-04 06:01    [W:2.504 / U:0.228 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site