Tejun Heo 4c81f045c0
ext4: fix racy use-after-free in ext4_end_io_dio() ...
ext4_end_io_dio() queues io_end->work and then clears iocb->private;
however, io_end->work calls aio_complete() which frees the iocb
object. If that slab object gets reallocated, then ext4_end_io_dio()
can end up clearing someone else's iocb->private, this use-after-free
can cause a leak of a struct ext4_io_end_t structure.
Detected and tested with slab poisoning.
[ Note: Can also reproduce using 12 fio's against 12 file systems with the
following configuration file:
[global]
direct=1
ioengine=libaio
iodepth=1
bs=4k
ba=4k
size=128m
[create]
filename=${TESTDIR}
rw=write
-- tytso ]
Google-Bug-Id: 5354697
Signed-off-by: Tejun Heo <tj@kernel.org >
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu >
Reported-by: Kent Overstreet <koverstreet@google.com >
Tested-by: Kent Overstreet <koverstreet@google.com >
Cc: stable@kernel.org
2011-11-24 19:22:24 -05:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-22 08:53:40 -08:00
2011-07-20 01:44:21 -04:00
2011-11-11 09:50:17 -08:00
2011-11-07 09:56:22 -08:00
2011-11-02 12:53:43 +01:00
2011-09-27 18:08:04 +02:00
2011-07-17 23:22:02 -04:00
2011-08-22 17:41:48 -07:00
2011-11-02 12:53:43 +01:00
2011-07-25 22:49:19 -07:00
2011-11-23 15:43:53 -06:00
2011-11-02 12:53:43 +01:00
2011-11-06 19:44:47 -08:00
2011-11-02 11:41:01 -07:00
2011-11-02 11:41:01 -07:00
2011-11-24 19:22:24 -05:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-07-21 10:59:16 -07:00
2011-11-06 19:44:47 -08:00
2011-11-06 19:44:47 -08:00
2011-11-15 14:29:42 -02:00
2011-11-02 12:53:43 +01:00
2011-11-02 11:41:01 -07:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-02 16:07:27 -07:00
2011-11-01 19:04:59 -04:00
2011-11-01 19:09:18 -04:00
2011-11-07 09:11:16 -08:00
2011-11-06 19:44:47 -08:00
2011-09-14 08:21:48 -04:00
2011-11-06 19:44:47 -08:00
2011-11-19 11:13:28 -05:00
2011-11-02 12:53:43 +01:00
2011-11-22 08:54:15 -08:00
2011-11-06 19:44:47 -08:00
2011-11-02 12:53:43 +01:00
2011-07-26 16:49:47 -07:00
2011-11-02 12:53:43 +01:00
2011-11-06 19:44:47 -08:00
2011-07-26 13:05:28 -04:00
2011-11-02 12:53:43 +01:00
2011-10-31 17:30:54 -07:00
2011-11-09 18:16:00 -05:00
2011-10-12 09:17:24 -07:00
2011-11-02 12:53:43 +01:00
2011-11-06 19:02:23 -08:00
2011-11-02 16:06:58 -07:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-04 16:48:37 -07:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:43 +01:00
2011-11-07 08:52:19 -08:00
2011-11-02 11:41:01 -07:00
2011-11-02 12:53:43 +01:00
2011-11-15 14:45:09 -06:00
2011-11-02 16:07:03 -07:00
2011-07-26 12:57:09 -04:00
2011-08-09 10:31:03 +10:00
2011-07-20 20:47:59 -04:00
2011-07-20 01:43:10 -04:00
2011-11-02 16:06:58 -07:00
2011-11-02 12:53:43 +01:00
2011-10-31 19:30:31 -04:00
2011-11-16 09:21:50 +01:00
2011-11-04 17:22:14 -07:00
2011-11-06 19:02:23 -08:00
2011-08-07 22:24:41 -07:00
2011-10-31 17:30:44 -07:00
2011-11-20 23:04:27 -05:00
2011-05-31 16:33:35 +02:00
2011-10-28 14:58:58 +02:00
2011-10-31 17:30:57 -07:00
2011-10-31 17:30:45 -07:00
2011-07-26 16:49:47 -07:00
2011-10-31 00:33:36 +08:00
2011-08-01 02:10:06 -04:00
2011-11-02 12:53:43 +01:00
2011-07-20 01:44:38 -04:00
2011-10-31 19:30:31 -04:00
2011-10-31 17:30:45 -07:00
2011-11-02 12:53:43 +01:00
2011-10-25 15:42:01 +02:00
2011-10-27 08:36:51 +02:00
2011-11-07 14:58:06 -08:00
2011-11-22 12:31:21 -05:00
2011-10-28 14:59:00 +02:00
2011-10-31 17:30:51 -07:00
2011-10-28 14:58:54 +02:00
2011-10-31 17:30:44 -07:00
2011-07-25 20:57:11 -07:00
2011-11-02 12:53:43 +01:00
2011-11-02 12:53:42 +01:00
2011-11-04 18:15:59 -07:00
2011-11-02 12:53:42 +01:00
2011-10-31 00:33:36 +08:00
2011-06-14 11:46:14 +02:00
2011-07-18 12:29:43 -04:00
4c81f045c0