Commit 4c81f045 authored by Tejun Heo's avatar Tejun Heo Committed by Theodore Ts'o

ext4: fix racy use-after-free in ext4_end_io_dio()

ext4_end_io_dio() queues io_end->work and then clears iocb->private;
however, io_end->work calls aio_complete() which frees the iocb
object.  If that slab object gets reallocated, then ext4_end_io_dio()
can end up clearing someone else's iocb->private, this use-after-free
can cause a leak of a struct ext4_io_end_t structure.

Detected and tested with slab poisoning.

[ Note: Can also reproduce using 12 fio's against 12 file systems with the
  following configuration file:

  [global]
  direct=1
  ioengine=libaio
  iodepth=1
  bs=4k
  ba=4k
  size=128m

  [create]
  filename=${TESTDIR}
  rw=write

  -- tytso ]

Google-Bug-Id: 5354697
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
Reported-by: default avatarKent Overstreet <koverstreet@google.com>
Tested-by: default avatarKent Overstreet <koverstreet@google.com>
Cc: stable@kernel.org
parent caca6a03
...@@ -2807,8 +2807,8 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset, ...@@ -2807,8 +2807,8 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
spin_unlock_irqrestore(&ei->i_completed_io_lock, flags); spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
/* queue the work to convert unwritten extents to written */ /* queue the work to convert unwritten extents to written */
queue_work(wq, &io_end->work);
iocb->private = NULL; iocb->private = NULL;
queue_work(wq, &io_end->work);
/* XXX: probably should move into the real I/O completion handler */ /* XXX: probably should move into the real I/O completion handler */
inode_dio_done(inode); inode_dio_done(inode);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment