diff options
| author | Kent Overstreet <kent.overstreet@linux.dev> | 2024-03-31 17:52:12 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-04-10 16:38:19 +0200 |
| commit | 9678bcc6234d83759fe091c197f5017a32b468da (patch) | |
| tree | 7a93d042bb02da9ce4eeeb4e08c2c7963af5bc49 | |
| parent | b06f306af91868c9d610816318099a86b45d457f (diff) | |
| download | linux-stable-9678bcc6234d83759fe091c197f5017a32b468da.tar.gz linux-stable-9678bcc6234d83759fe091c197f5017a32b468da.tar.bz2 linux-stable-9678bcc6234d83759fe091c197f5017a32b468da.zip | |
aio: Fix null ptr deref in aio_complete() wakeup
commit caeb4b0a11b3393e43f7fa8e0a5a18462acc66bd upstream.
list_del_init_careful() needs to be the last access to the wait queue
entry - it effectively unlocks access.
Previously, finish_wait() would see the empty list head and skip taking
the lock, and then we'd return - but the completion path would still
attempt to do the wakeup after the task_struct pointer had been
overwritten.
Fixes: 71eb6b6b0ba9 ("fs/aio: obey min_nr when doing wakeups")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-fsdevel/CAHTA-ubfwwB51A5Wg5M6H_rPEQK9pNf8FkAGH=vr=FEkyRrtqw@mail.gmail.com/
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Link: https://lore.kernel.org/stable/20240331215212.522544-1-kent.overstreet%40linux.dev
Link: https://lore.kernel.org/r/20240331215212.522544-1-kent.overstreet@linux.dev
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/aio.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -1202,8 +1202,8 @@ static void aio_complete(struct aio_kiocb *iocb) spin_lock_irqsave(&ctx->wait.lock, flags); list_for_each_entry_safe(curr, next, &ctx->wait.head, w.entry) if (avail >= curr->min_nr) { - list_del_init_careful(&curr->w.entry); wake_up_process(curr->w.private); + list_del_init_careful(&curr->w.entry); } spin_unlock_irqrestore(&ctx->wait.lock, flags); } |