| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1359502081-20240-4-git-send-email-jack@suse.cz> Date: Wed, 30 Jan 2013 00:28:00 +0100 From: Jan Kara <jack@...e.cz> To: Al Viro <viro@...IV.linux.org.uk> Cc: linux-fsdevel@...r.kernel.org, xfs@....sgi.com, linux-ext4@...r.kernel.org, ocfs2-devel@....oracle.com, Jan Kara <jack@...e.cz>, Joel Becker <jlbec@...lplan.org>, stable@...r.kernel.org Subject: [PATCH 3/4] ocfs2: Fix possible use-after-free with AIO Running AIO is pinning inode in memory using file reference. Once AIO is completed using aio_complete(), file reference is put and inode can be freed from memory. So we have to be sure that calling aio_complete() is the last thing we do with the inode. CC: Joel Becker <jlbec@...lplan.org> CC: ocfs2-devel@....oracle.com CC: stable@...r.kernel.org Acked-by: Jeff Moyer <jmoyer@...hat.com> Signed-off-by: Jan Kara <jack@...e.cz> --- fs/ocfs2/aops.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c index 6577432..340bd02 100644 --- a/fs/ocfs2/aops.c +++ b/fs/ocfs2/aops.c @@ -593,9 +593,9 @@ static void ocfs2_dio_end_io(struct kiocb *iocb, level = ocfs2_iocb_rw_locked_level(iocb); ocfs2_rw_unlock(inode, level); + inode_dio_done(inode); if (is_async) aio_complete(iocb, ret, 0); - inode_dio_done(inode); } /* -- 1.7.1 -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists