1. 25 Nov, 2011 1 commit
    • Tejun Heo's avatar
      ext4: fix racy use-after-free in ext4_end_io_dio() · 4c81f045
      Tejun Heo authored
      ext4_end_io_dio() queues io_end->work and then clears iocb->private;
      however, io_end->work calls aio_complete() which frees the iocb
      object.  If that slab object gets reallocated, then ext4_end_io_dio()
      can end up clearing someone else's iocb->private, this use-after-free
      can cause a leak of a struct ext4_io_end_t structure.
      
      Detected and tested with slab poisoning.
      
      [ Note: Can also reproduce using 12 fio's against 12 file systems with the
        following configuration file:
      
        [global]
        direct=1
        ioengine=libaio
        iodepth=1
        bs=4k
        ba=4k
        size=128m
      
        [create]
        filename=${TESTDIR}
        rw=write
      
        -- tytso ]
      
      Google-Bug-Id: 5354697
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
      Reported-by: default avatarKent Overstreet <koverstreet@google.com>
      Tested-by: default avatarKent Overstreet <koverstreet@google.com>
      Cc: stable@kernel.org
      4c81f045
  2. 24 Nov, 2011 6 commits
  3. 23 Nov, 2011 15 commits
  4. 22 Nov, 2011 18 commits