From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1764072AbXHVJNf (ORCPT ); Wed, 22 Aug 2007 05:13:35 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1759197AbXHVIyG (ORCPT ); Wed, 22 Aug 2007 04:54:06 -0400 Received: from 1wt.eu ([62.212.114.60]:2182 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759173AbXHVIyF (ORCPT ); Wed, 22 Aug 2007 04:54:05 -0400 From: Willy Tarreau Message-Id: <20070822084042.%N@1wt.eu> References: <20070822083844.%N@1wt.eu> User-Agent: quilt/0.46-1 Date: Wed, 22 Aug 2007 11:39:37 +0200 To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Badari Pulavarty , Joe Jin , Zach Brown , gurudas pai , Andrew Morton , Greg Kroah-Hartman , Willy Tarreau Subject: [2.6.20.17 review 53/58] direct-io: fix error-path crashes Content-Disposition: inline; filename=0053-direct-io-fix-error-path-crashes.patch Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Need to initialize map_bh.b_state to zero. Otherwise, in case of a faulty user-buffer its possible to go into dio_zero_block() and submit a page by mistake - since it checks for buffer_new(). http://marc.info/?l=linux-kernel&m=118551339032528&w=2 akpm: Linus had a (better) patch to just do a kzalloc() in there, but it got lost. Probably this version is better for -stable anwyay. Signed-off-by: Badari Pulavarty Acked-by: Joe Jin Acked-by: Zach Brown Cc: gurudas pai Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Signed-off-by: Willy Tarreau --- fs/direct-io.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/fs/direct-io.c b/fs/direct-io.c index d9d0833..0286993 100644 --- a/fs/direct-io.c +++ b/fs/direct-io.c @@ -978,6 +978,7 @@ direct_io_worker(int rw, struct kiocb *iocb, struct inode *inode, dio->get_block = get_block; dio->end_io = end_io; dio->map_bh.b_private = NULL; + dio->map_bh.b_state = 0; dio->final_block_in_bio = -1; dio->next_block_for_io = -1; -- 1.5.2.5 --