lkml.org 
[lkml]   [2013]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 1/3] aio: Fix a null pointer deref in batch_complete_aio
Date
The batch completion code was trying to be a bit too clever, and skip
checking ctx where it couldn't be NULL - but that broke if a kiocb had
been cancelled. Move the check to kioctx_ring_unlock().

Reported-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
Signed-off-by: Kent Overstreet <koverstreet@google.com>
---
fs/aio.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/aio.c b/fs/aio.c
index 62573d3..0d2f39d 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -683,6 +683,9 @@ static inline void kioctx_ring_unlock(struct kioctx *ctx, unsigned tail)
{
struct aio_ring *ring;

+ if (!ctx)
+ return;
+
smp_wmb();
/* make event visible before updating tail */

@@ -760,8 +763,7 @@ void batch_complete_aio(struct batch_complete *batch)
}

if (unlikely(req->ki_ctx != ctx)) {
- if (ctx)
- kioctx_ring_unlock(ctx, tail);
+ kioctx_ring_unlock(ctx, tail);

ctx = req->ki_ctx;
tail = kioctx_ring_lock(ctx);
--
1.7.12


\
 
 \ /
  Last update: 2013-01-25 01:41    [W:0.131 / U:2.556 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site