diff options
| author | Benjamin LaHaise <bcrl@kvack.org> | 2014-06-24 13:12:55 -0400 |
|---|---|---|
| committer | Paul Mackerras <paulus@samba.org> | 2014-08-19 16:25:05 +1000 |
| commit | 921b1130a9c76a9c88f8568b33faab083072879e (patch) | |
| tree | b706b0a104ccb89efbfa8466d62c71d8a0e2ebfe | |
| parent | bf42fe75387d19bd4b21f3325dde7f12420721f8 (diff) | |
| download | powerpc-921b1130a9c76a9c88f8568b33faab083072879e.tar.gz | |
aio: fix aio request leak when events are reaped by userspace
commit f8567a3845ac05bb28f3c1b478ef752762bd39ef upstream.
The aio cleanups and optimizations by kmo that were merged into the 3.10
tree added a regression for userspace event reaping. Specifically, the
reference counts are not decremented if the event is reaped in userspace,
leading to the application being unable to submit further aio requests.
This patch applies to 3.12+. A separate backport is required for 3.10/3.11.
This issue was uncovered as part of CVE-2014-0206.
[jmoyer@redhat.com: backported to 3.10]
Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Cc: Kent Overstreet <kmo@daterainc.com>
Cc: Mateusz Guzik <mguzik@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6745cb91b5ec93a1b34221279863926fba43d0d7)
Signed-off-by: Paul Mackerras <paulus@samba.org>
| -rw-r--r-- | fs/aio.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/fs/aio.c b/fs/aio.c index ebd06fd0de89c8..8d2c997a550c82 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -310,7 +310,6 @@ static void free_ioctx(struct kioctx *ctx) avail = (head <= ctx->tail ? ctx->tail : ctx->nr_events) - head; - atomic_sub(avail, &ctx->reqs_active); head += avail; head %= ctx->nr_events; } @@ -678,6 +677,7 @@ void aio_complete(struct kiocb *iocb, long res, long res2) put_rq: /* everything turned out well, dispose of the aiocb. */ aio_put_req(iocb); + atomic_dec(&ctx->reqs_active); /* * We have to order our ring_info tail store above and test @@ -755,8 +755,6 @@ static long aio_read_events_ring(struct kioctx *ctx, flush_dcache_page(ctx->ring_pages[0]); pr_debug("%li h%u t%u\n", ret, head, ctx->tail); - - atomic_sub(ret, &ctx->reqs_active); out: mutex_unlock(&ctx->ring_lock); |