Commit e5313c14 authored by Omar Sandoval's avatar Omar Sandoval Committed by Jens Axboe

loop: remove union of use_aio and ref in struct loop_cmd

When the request is completed, lo_complete_rq() checks cmd->use_aio.
However, if this is in fact an aio request, cmd->use_aio will have
already been reused as cmd->ref by lo_rw_aio*. Fix it by not using a
union. On x86_64, there's a hole after the union anyways, so this
doesn't make struct loop_cmd any bigger.

Fixes: 92d77332 ("block/loop: fix use after free")
Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 5acb3cc2
...@@ -67,10 +67,8 @@ struct loop_device { ...@@ -67,10 +67,8 @@ struct loop_device {
struct loop_cmd { struct loop_cmd {
struct kthread_work work; struct kthread_work work;
struct request *rq; struct request *rq;
union { bool use_aio; /* use AIO interface to handle I/O */
bool use_aio; /* use AIO interface to handle I/O */ atomic_t ref; /* only for aio */
atomic_t ref; /* only for aio */
};
long ret; long ret;
struct kiocb iocb; struct kiocb iocb;
struct bio_vec *bvec; struct bio_vec *bvec;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment