ext4: fix racy use-after-free in ext4_end_io_dio()
ext4_end_io_dio() queues io_end->work and then clears iocb->private; however, io_end->work calls aio_complete() which frees the iocb object. If that slab object gets reallocated, then ext4_end_io_dio() can end up clearing someone else's iocb->private, this use-after-free can cause a leak of a struct ext4_io_end_t structure. Detected and tested with slab poisoning. [ Note: Can also reproduce using 12 fio's against 12 file systems with the following configuration file: [global] direct=1 ioengine=libaio iodepth=1 bs=4k ba=4k size=128m [create] filename=${TESTDIR} rw=write -- tytso ] Google-Bug-Id: 5354697 Signed-off-by: NTejun Heo <tj@kernel.org> Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu> Reported-by: NKent Overstreet <koverstreet@google.com> Tested-by: NKent Overstreet <koverstreet@google.com> Cc: stable@kernel.org
Showing
想要评论请 注册 或 登录