[PATCH 1/2] aio: prevent double free in ioctx_alloc

[PATCH 1/2] aio: prevent double free in ioctx_alloc

[Sasha Levin]

ioctx_alloc() calls aio_setup_ring() to allocate a ring. If aio_setup_ring()
fails to do so it would call aio_free_ring() before returning, but
ioctx_alloc() would call aio_free_ring() again causing a double free of
the ring.

This is easily reproducible from userspace.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
 fs/aio.c |    1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/aio.c b/fs/aio.c
index 699f53e..8b387a1 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -661,7 +661,6 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
 err_cleanup:
 	aio_nr_sub(ctx->max_reqs);
 err:
-	aio_free_ring(ctx);
 	free_percpu(ctx->cpu);
 	free_percpu(ctx->reqs.pcpu_count);
 	free_percpu(ctx->users.pcpu_count);
-- 
1.7.10.4

--
To unsubscribe, send a message with 'unsubscribe linux-aio' in
the body to majordomo@kvack.org.  For more info on Linux AIO,
see: http://www.kvack.org/aio/
Don't email: <a href=mailto:"aart@kvack.org">aart@kvack.org</a>

[PATCH 2/2] aio: nullify aio->ring_pages after freeing it

[Sasha Levin]

After freeing ring_pages we leave it as is causing a dangling pointer. This
has already caused an issue so to help catching any issues in the future
NULL it out.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
 fs/aio.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/aio.c b/fs/aio.c
index 8b387a1..d6e8467 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -251,8 +251,10 @@ static void aio_free_ring(struct kioctx *ctx)
 
 	put_aio_ring_file(ctx);
 
-	if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages)
+	if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages) {
 		kfree(ctx->ring_pages);
+		ctx->ring_pages = NULL;
+	}
 }
 
 static int aio_ring_mmap(struct file *file, struct vm_area_struct *vma)
-- 
1.7.10.4

--
To unsubscribe, send a message with 'unsubscribe linux-aio' in
the body to majordomo@kvack.org.  For more info on Linux AIO,
see: http://www.kvack.org/aio/
Don't email: <a href=mailto:"aart@kvack.org">aart@kvack.org</a>

Re: [PATCH 1/2] aio: prevent double free in ioctx_alloc

[Benjamin LaHaise]

On Tue, Nov 19, 2013 at 05:33:02PM -0500, Sasha Levin wrote:
> ioctx_alloc() calls aio_setup_ring() to allocate a ring. If aio_setup_ring()
> fails to do so it would call aio_free_ring() before returning, but
> ioctx_alloc() would call aio_free_ring() again causing a double free of
> the ring.
> 
> This is easily reproducible from userspace.

I've applied this to my aio-next tree at git://git.kvack.org/~bcrl/aio-next.git
.  Please verify that it applied correctly, as that tree also includes 
another fix from Kent relating to the percpu reference bits.

		-ben
-- 
"Thought is the essence of where you are now."

--
To unsubscribe, send a message with 'unsubscribe linux-aio' in
the body to majordomo@kvack.org.  For more info on Linux AIO,
see: http://www.kvack.org/aio/
Don't email: <a href=mailto:"aart@kvack.org">aart@kvack.org</a>

Re: [PATCH 2/2] aio: nullify aio->ring_pages after freeing it

[Benjamin LaHaise]

On Tue, Nov 19, 2013 at 05:33:03PM -0500, Sasha Levin wrote:
> After freeing ring_pages we leave it as is causing a dangling pointer. This
> has already caused an issue so to help catching any issues in the future
> NULL it out.

Applied as well,  I'll send this out after running some tests on the 
resulting tree tonight.

		-ben
-- 
"Thought is the essence of where you are now."

--
To unsubscribe, send a message with 'unsubscribe linux-aio' in
the body to majordomo@kvack.org.  For more info on Linux AIO,
see: http://www.kvack.org/aio/
Don't email: <a href=mailto:"aart@kvack.org">aart@kvack.org</a>