korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-29 23:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

aio: fix aio request leak when events are reaped by userspace

Browse Source 
The aio cleanups and optimizations by kmo that were merged into the 3.10
tree added a regression for userspace event reaping.  Specifically, the
reference counts are not decremented if the event is reaped in userspace,
leading to the application being unable to submit further aio requests.
This patch applies to 3.12+.  A separate backport is required for 3.10/3.11.
This issue was uncovered as part of CVE-2014-0206.

Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
Cc: stable@vger.kernel.org
Cc: Kent Overstreet <kmo@daterainc.com>
Cc: Mateusz Guzik <mguzik@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
This commit is contained in:
Benjamin LaHaise 2014-06-24 13:12:55 -04:00
parent 8b8f5d9715
commit f8567a3845
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/aio.c
View File

@ -1021,6 +1021,7 @@ void aio_complete(struct kiocb *iocb, long res, long res2)
/* everything turned out well, dispose of the aiocb. */ /* everything turned out well, dispose of the aiocb. */
kiocb_free(iocb); kiocb_free(iocb);
put_reqs_available(ctx, 1);
/* /*
* We have to order our ring_info tail store above and test * We have to order our ring_info tail store above and test
@ -1100,8 +1101,6 @@ static long aio_read_events_ring(struct kioctx *ctx,
flush_dcache_page(ctx->ring_pages[0]); flush_dcache_page(ctx->ring_pages[0]);
pr_debug("%li h%u t%u\n", ret, head, tail); pr_debug("%li h%u t%u\n", ret, head, tail);
put_reqs_available(ctx, ret);
out: out:
mutex_unlock(&ctx->ring_lock); mutex_unlock(&ctx->ring_lock);