On Mon 25-02-13 10:03:55, [email protected] wrote:
> The patch below does not apply to the 3.8-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <[email protected]>.
Hum, but the patch already is in 3.8 as commit 4b05d09c. I'm not sure how
it got into your queue for 3.8...
Honza
> ------------------ original commit in Linus's tree ------------------
>
> From ced55f38d6bde7c10a14ea51c2edcd51a98575e3 Mon Sep 17 00:00:00 2001
> From: Jan Kara <[email protected]>
> Date: Wed, 23 Jan 2013 13:56:18 +0100
> Subject: [PATCH] xfs: Fix possible use-after-free with AIO
>
> Running AIO is pinning inode in memory using file reference. Once AIO
> is completed using aio_complete(), file reference is put and inode can
> be freed from memory. So we have to be sure that calling aio_complete()
> is the last thing we do with the inode.
>
> CC: [email protected]
> CC: Ben Myers <[email protected]>
> CC: [email protected]
> Signed-off-by: Jan Kara <[email protected]>
> Reviewed-by: Ben Myers <[email protected]>
> Signed-off-by: Ben Myers <[email protected]>
>
> diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
> index 4111a40..5f707e5 100644
> --- a/fs/xfs/xfs_aops.c
> +++ b/fs/xfs/xfs_aops.c
> @@ -86,11 +86,11 @@ xfs_destroy_ioend(
> }
>
> if (ioend->io_iocb) {
> + inode_dio_done(ioend->io_inode);
> if (ioend->io_isasync) {
> aio_complete(ioend->io_iocb, ioend->io_error ?
> ioend->io_error : ioend->io_result, 0);
> }
> - inode_dio_done(ioend->io_inode);
> }
>
> mempool_free(ioend, xfs_ioend_pool);
>
--
Jan Kara <[email protected]>
SUSE Labs, CR
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
