Messages in this thread | | | Date | Tue, 23 Nov 2021 11:49:54 -0800 | From | Eric Biggers <> | Subject | Re: [PATCH v5] aio: Add support for the POLLFREE |
| |
On Wed, Oct 27, 2021 at 01:18:34AM +0000, Ramji Jiyani wrote: > Add support for the POLLFREE flag to force complete iocb inline in > aio_poll_wake(). A thread may use it to signal it's exit and/or request > to cleanup while pending poll request. In this case, aio_poll_wake() > needs to make sure it doesn't keep any reference to the queue entry > before returning from wake to avoid possible use after free via > poll_cancel() path. > > UAF issue was found during binder and aio interactions in certain > sequence of events [1]. > > The POLLFREE flag is no more exclusive to the epoll and is being > shared with the aio. Remove comment from poll.h to avoid confusion. > > [1] https://lore.kernel.org/r/CAKUd0B_TCXRY4h1hTztfwWbNSFQqsudDLn2S_28csgWZmZAG3Q@mail.gmail.com/ > > Fixes: af5c72b1fc7a ("Fix aio_poll() races") > Signed-off-by: Ramji Jiyani <ramjiyani@google.com> > Reviewed-by: Jeff Moyer <jmoyer@redhat.com> > Reviewed-by: Christoph Hellwig <hch@lst.de> > Cc: stable@vger.kernel.org # 4.19+ > ---
Looks good, feel free to add:
Reviewed-by: Eric Biggers <ebiggers@google.com>
I'm still not 100% happy with the commit message, but it's good enough. The actual code looks correct.
Who is going to take this patch? This is an important fix; it shouldn't be sitting ignored for months. get_maintainer.pl shows:
$ ./scripts/get_maintainer.pl fs/aio.c Benjamin LaHaise <bcrl@kvack.org> (supporter:AIO) Alexander Viro <viro@zeniv.linux.org.uk> (maintainer:FILESYSTEMS (VFS and infrastructure)) linux-aio@kvack.org (open list:AIO) linux-fsdevel@vger.kernel.org (open list:FILESYSTEMS (VFS and infrastructure)) linux-kernel@vger.kernel.org (open list)
- Eric
| |