lkml.org 
[lkml]   [2011]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] ext4: fix racy use-after-free in ext4_end_io_dio()
    ext4_end_io_dio() queues io_end->work and then clears iocb->private;
    however, io_end->work completes the iocb by calling aio_complete(),
    which may happen before io_end->work clearing thus leading to
    use-after-free.

    Detected and tested with slab poisoning.

    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Kent Overstreet <koverstreet@google.com>
    Tested-by: Kent Overstreet <koverstreet@google.com>
    Cc: stable@kernel.org
    ---
    I *think* this is the corret fix but am not too familiar with code
    path, so please proceed with caution.

    Thank you.

    fs/ext4/inode.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
    index 240f6e2..0f5583b 100644
    --- a/fs/ext4/inode.c
    +++ b/fs/ext4/inode.c
    @@ -2806,8 +2806,8 @@ out:
    spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);

    /* queue the work to convert unwritten extents to written */
    - queue_work(wq, &io_end->work);
    iocb->private = NULL;
    + queue_work(wq, &io_end->work);

    /* XXX: probably should move into the real I/O completion handler */
    inode_dio_done(inode);

    \
     
     \ /
      Last update: 2011-11-24 20:49    [W:0.020 / U:30.352 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site