linux-kernel - Re: [PATCH 1/3] aio: Fix a null pointer deref in batch_complete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 25 Jan 2013 21:15:37 +0800
From:	Hillf Danton <dhillf@...il.com>
To:	Kent Overstreet <koverstreet@...gle.com>
Cc:	akpm@...ux-foundation.org, Valdis.Kletnieks@...edu, bcrl@...ck.org,
	zab@...bo.net, linux-kernel@...r.kernel.org, linux-aio@...ck.org,
	linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH 1/3] aio: Fix a null pointer deref in batch_complete_aio

On Fri, Jan 25, 2013 at 5:43 AM, Kent Overstreet <koverstreet@...gle.com> wrote:
> The batch completion code was trying to be a bit too clever, and skip
> checking ctx where it couldn't be NULL - but that broke if a kiocb had
> been cancelled. Move the check to kioctx_ring_unlock().
>
> Reported-by: Valdis Kletnieks <Valdis.Kletnieks@...edu>
> Signed-off-by: Kent Overstreet <koverstreet@...gle.com>
> ---

Acked-by: Hillf Danton <dhillf@...il.com>

>  fs/aio.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/fs/aio.c b/fs/aio.c
> index 62573d3..0d2f39d 100644
> --- a/fs/aio.c
> +++ b/fs/aio.c
> @@ -683,6 +683,9 @@ static inline void kioctx_ring_unlock(struct kioctx *ctx, unsigned tail)
>  {
>         struct aio_ring *ring;
>
> +       if (!ctx)
> +               return;
> +
>         smp_wmb();
>         /* make event visible before updating tail */
>
> @@ -760,8 +763,7 @@ void batch_complete_aio(struct batch_complete *batch)
>                 }
>
>                 if (unlikely(req->ki_ctx != ctx)) {
> -                       if (ctx)
> -                               kioctx_ring_unlock(ctx, tail);
> +                       kioctx_ring_unlock(ctx, tail);
>
>                         ctx = req->ki_ctx;
>                         tail = kioctx_ring_lock(ctx);
> --
> 1.7.12
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/