From patchwork Thu Feb 28 11:57:27 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Henriques X-Patchwork-Id: 223902 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 7E6012C02AE for ; Thu, 28 Feb 2013 22:57:45 +1100 (EST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1UB279-0003Mg-NP; Thu, 28 Feb 2013 11:57:31 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1UB278-0003M7-1m for kernel-team@lists.ubuntu.com; Thu, 28 Feb 2013 11:57:30 +0000 Received: from [188.250.143.69] (helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1UB277-0005vo-Mf; Thu, 28 Feb 2013 11:57:30 +0000 From: Luis Henriques To: Jan Kara Subject: [ 3.5.y.z extended stable ] Patch "ext4: fix possible use-after-free with AIO" has been added to staging queue Date: Thu, 28 Feb 2013 11:57:27 +0000 Message-Id: <1362052647-19001-1-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 1.8.1.2 X-Extended-Stable: 3.5 Cc: Jeff Moyer , Theodore Ts'o , kernel-team@lists.ubuntu.com, Carlos Maiolino X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com This is a note to let you know that I have just added a patch titled ext4: fix possible use-after-free with AIO to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree which can be found at: http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.5.y.z tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Luis ------ From 5b420acb3b0b9d0f9b886c2409ff80a0e5613bd4 Mon Sep 17 00:00:00 2001 From: Jan Kara Date: Tue, 29 Jan 2013 22:48:17 -0500 Subject: [PATCH] ext4: fix possible use-after-free with AIO commit 091e26dfc156aeb3b73bc5c5f277e433ad39331c upstream. Running AIO is pinning inode in memory using file reference. Once AIO is completed using aio_complete(), file reference is put and inode can be freed from memory. So we have to be sure that calling aio_complete() is the last thing we do with the inode. Reviewed-by: Carlos Maiolino Acked-by: Jeff Moyer Signed-off-by: Jan Kara Signed-off-by: "Theodore Ts'o" [ luis: adjust context ] Signed-off-by: Luis Henriques --- fs/ext4/inode.c | 2 +- fs/ext4/page-io.c | 10 ++++------ 2 files changed, 5 insertions(+), 7 deletions(-) -- 1.8.1.2 diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 20b2687..0589bb2 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2867,9 +2867,9 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset, if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) { ext4_free_io_end(io_end); out: + inode_dio_done(inode); if (is_async) aio_complete(iocb, ret, 0); - inode_dio_done(inode); return; } diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c index dcdeef1..7e04138 100644 --- a/fs/ext4/page-io.c +++ b/fs/ext4/page-io.c @@ -106,15 +106,13 @@ int ext4_end_io_nolock(ext4_io_end_t *io) "(inode %lu, offset %llu, size %zd, error %d)", inode->i_ino, offset, size, ret); } - - if (io->iocb) - aio_complete(io->iocb, io->result, 0); - - if (io->flag & EXT4_IO_END_DIRECT) - inode_dio_done(inode); /* Wake up anyone waiting on unwritten extent conversion */ if (atomic_dec_and_test(&EXT4_I(inode)->i_aiodio_unwritten)) wake_up_all(ext4_ioend_wq(io->inode)); + if (io->flag & EXT4_IO_END_DIRECT) + inode_dio_done(inode); + if (io->iocb) + aio_complete(io->iocb, io->result, 0); return ret; }