From mboxrd@z Thu Jan 1 00:00:00 1970 From: Benjamin LaHaise Subject: Re: [PATCH 1/2] aio: prevent double free in ioctx_alloc Date: Tue, 19 Nov 2013 17:45:13 -0500 Message-ID: <20131119224513.GF14098@kvack.org> References: <1384900383-22009-1-git-send-email-sasha.levin@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: viro@zeniv.linux.org.uk, linux-aio@kvack.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org To: Sasha Levin Return-path: Content-Disposition: inline In-Reply-To: <1384900383-22009-1-git-send-email-sasha.levin@oracle.com> Sender: owner-linux-aio@kvack.org List-Id: linux-fsdevel.vger.kernel.org On Tue, Nov 19, 2013 at 05:33:02PM -0500, Sasha Levin wrote: > ioctx_alloc() calls aio_setup_ring() to allocate a ring. If aio_setup_ring() > fails to do so it would call aio_free_ring() before returning, but > ioctx_alloc() would call aio_free_ring() again causing a double free of > the ring. > > This is easily reproducible from userspace. I've applied this to my aio-next tree at git://git.kvack.org/~bcrl/aio-next.git . Please verify that it applied correctly, as that tree also includes another fix from Kent relating to the percpu reference bits. -ben -- "Thought is the essence of where you are now." -- To unsubscribe, send a message with 'unsubscribe linux-aio' in the body to majordomo@kvack.org. For more info on Linux AIO, see: http://www.kvack.org/aio/ Don't email: aart@kvack.org