On Tue, Nov 19, 2013 at 05:33:02PM -0500, Sasha Levin wrote: > ioctx_alloc() calls aio_setup_ring() to allocate a ring. If aio_setup_ring() > fails to do so it would call aio_free_ring() before returning, but > ioctx_alloc() would call aio_free_ring() again causing a double free of > the ring. > > This is easily reproducible from userspace. I've applied this to my aio-next tree at git://git.kvack.org/~bcrl/aio-next.git . Please verify that it applied correctly, as that tree also includes another fix from Kent relating to the percpu reference bits. -ben -- "Thought is the essence of where you are now." -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
