aboutsummaryrefslogtreecommitdiff
path: root/kernel
diff options
context:
space:
mode:
authorAl Viro <viro@ZenIV.linux.org.uk>2012-03-07 05:16:35 +0000
committerLinus Torvalds <torvalds@linux-foundation.org>2012-03-09 18:59:59 -0800
commit86b62a2cb4fc09037bbce2959d2992962396fd7f (patch)
treeea45bb1de1f49862415b5643dea840318d02ee67 /kernel
parent86e06008338e5712603613a0f6770500f79e83bd (diff)
downloadlinux-stericsson-86b62a2cb4fc09037bbce2959d2992962396fd7f.tar.gz
aio: fix io_setup/io_destroy race
Have ioctx_alloc() return an extra reference, so that caller would drop it on success and not bother with re-grabbing it on failure exit. The current code is obviously broken - io_destroy() from another thread that managed to guess the address io_setup() would've returned would free ioctx right under us; gets especially interesting if aio_context_t * we pass to io_setup() points to PROT_READ mapping, so put_user() fails and we end up doing io_destroy() on kioctx another thread has just got freed... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Acked-by: Benjamin LaHaise <bcrl@kvack.org> Reviewed-by: Jeff Moyer <jmoyer@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions