[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <295052.1716298587@warthog.procyon.org.uk>
Date: Tue, 21 May 2024 14:36:27 +0100
From: David Howells <dhowells@...hat.com>
To: Steve French <stfrench@...rosoft.com>
cc: dhowells@...hat.com, Jeff Layton <jlayton@...nel.org>,
Enzo Matsumiya <ematsumiya@...e.de>,
Christian Brauner <brauner@...nel.org>, netfs@...ts.linux.dev,
v9fs@...ts.linux.dev, linux-afs@...ts.infradead.org,
linux-cifs@...r.kernel.org, linux-fsdevel@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: [PATCH] netfs: Fix AIO error handling when doing write-through
If an error occurs whilst we're doing an AIO write in write-through mode,
we may end up calling ->ki_complete() *and* returning an error from
->write_iter(). This can result in either a UAF (the ->ki_complete() func
pointer may get overwritten, for example) or a refcount underflow in
io_submit() as ->ki_complete is called twice.
Fix this by making netfs_end_writethrough() - and thus
netfs_perform_write() - unconditionally return -EIOCBQUEUED if we're doing
an AIO write and wait for completion if we're not.
Fixes: 288ace2f57c9 ("netfs: New writeback implementation")
Signed-off-by: David Howells <dhowells@...hat.com>
cc: Jeff Layton <jlayton@...nel.org>
cc: Enzo Matsumiya <ematsumiya@...e.de>
cc: netfs@...ts.linux.dev
cc: v9fs@...ts.linux.dev
cc: linux-afs@...ts.infradead.org
cc: linux-cifs@...r.kernel.org
cc: linux-fsdevel@...r.kernel.org
---
fs/netfs/write_issue.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
index e190043bc0da..acbfd1f5ee9d 100644
--- a/fs/netfs/write_issue.c
+++ b/fs/netfs/write_issue.c
@@ -636,7 +636,12 @@ int netfs_end_writethrough(struct netfs_io_request *wreq, struct writeback_contr
mutex_unlock(&ictx->wb_lock);
- ret = wreq->error;
+ if (wreq->iocb) {
+ ret = -EIOCBQUEUED;
+ } else {
+ wait_on_bit(&wreq->flags, NETFS_RREQ_IN_PROGRESS, TASK_UNINTERRUPTIBLE);
+ ret = wreq->error;
+ }
netfs_put_request(wreq, false, netfs_rreq_trace_put_return);
return ret;
}
Powered by blists - more mailing lists