From 5352ae35937e0efb3e63967ea5f435c6321000c9 Mon Sep 17 00:00:00 2001 From: yangerkun Date: Fri, 22 Feb 2019 22:05:07 +0800 Subject: [PATCH] aio: add percpu_ref_put while goto out in do_io_getevents euler inclusion category: bugfix bugzilla: 10652 CVE: NA ------------------------------------------------------------------------- Commit 05b36af7e25("aio: make sure the input "timeout" value is valid") forget to call percpu_ref_put when ts is invalid. Fixes: 05b36af("aio: make sure the input "timeout" value is valid") Signed-off-by: yangerkun Reviewed-by: Yang Yingliang Reviewed-by: Hou Tao Signed-off-by: Yang Yingliang --- fs/aio.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index 0ebf195fb371..68abde710afb 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -2046,12 +2046,14 @@ static long do_io_getevents(aio_context_t ctx_id, if (likely(ioctx)) { ktime_t until; - if (!ts) + if (!ts) { until = KTIME_MAX; - else if (!timespec64_valid(ts)) + } else if (!timespec64_valid(ts)) { + percpu_ref_put(&ioctx->users); goto out; - else + } else { until = timespec64_to_ktime(*ts); + } if (likely(min_nr <= nr && min_nr >= 0)) ret = read_events(ioctx, min_nr, nr, events, until); -- GitLab