From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ipmail03.adl6.internode.on.net ([150.101.137.143]:12557 "EHLO ipmail03.adl6.internode.on.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726905AbfAQV1B (ORCPT ); Thu, 17 Jan 2019 16:27:01 -0500 Date: Fri, 18 Jan 2019 08:26:58 +1100 From: Dave Chinner Subject: Re: [PATCH] iomap: fix a use after free in iomap_dio_rw Message-ID: <20190117212658.GD6173@dastard> References: <20190117075707.8640-1-hch@lst.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190117075707.8640-1-hch@lst.de> Sender: linux-xfs-owner@vger.kernel.org List-ID: List-Id: xfs To: Christoph Hellwig Cc: linux-xfs@vger.kernel.org, linux-fsdevel@vger.kernel.org, Chandan Rajendra , "Darrick J . Wong" On Thu, Jan 17, 2019 at 08:57:07AM +0100, Christoph Hellwig wrote: > Introduce a local wait_for_completion variable to avoid an access to the > potentially freed dio struture after dropping the last reference count. > > Also use the chance to document the completion behavior to make the > refcounting clear to the reader of the code. > > Fixes: ff6a9292e6 ("iomap: implement direct I/O") > Reported-by: Chandan Rajendra > Reported-by: Darrick J. Wong > Signed-off-by: Christoph Hellwig > Tested-by: Chandan Rajendra > Tested-by: Darrick J. Wong > --- > fs/iomap.c | 28 +++++++++++++++++++++------- > 1 file changed, 21 insertions(+), 7 deletions(-) Looks good, minor comment cleanup needed, though. maybe Darrick can do it on commit? Reviewed-by: Dave Chinner > @@ -1925,8 +1925,24 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, > if (dio->flags & IOMAP_DIO_WRITE_FUA) > dio->flags &= ~IOMAP_DIO_NEED_SYNC; > > + /* > + * We are about to drop our additional submission reference, which > + * might be the last reference to the dio. There are three three > + * different ways we can progress here: > + * > + * (a) If this is the last reference we will always complete and free > + * the dio ourselves. right here. s/ right here.// -Dave. -- Dave Chinner david@fromorbit.com