This is a note to let you know that I've just added the patch titled
aio: prevent double free in ioctx_alloc
to the 3.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
aio-prevent-double-free-in-ioctx_alloc.patch
and it can be found in the queue-3.12 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From d558023207e008a4476a3b7bb8706b2a2bf5d84f Mon Sep 17 00:00:00 2001
From: Sasha Levin <sasha.levin@xxxxxxxxxx>
Date: Tue, 19 Nov 2013 17:33:02 -0500
Subject: aio: prevent double free in ioctx_alloc
From: Sasha Levin <sasha.levin@xxxxxxxxxx>
commit d558023207e008a4476a3b7bb8706b2a2bf5d84f upstream.
ioctx_alloc() calls aio_setup_ring() to allocate a ring. If aio_setup_ring()
fails to do so it would call aio_free_ring() before returning, but
ioctx_alloc() would call aio_free_ring() again causing a double free of
the ring.
This is easily reproducible from userspace.
Signed-off-by: Sasha Levin <sasha.levin@xxxxxxxxxx>
Signed-off-by: Benjamin LaHaise <bcrl@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/aio.c | 1 -
1 file changed, 1 deletion(-)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -661,7 +661,6 @@ static struct kioctx *ioctx_alloc(unsign
err_cleanup:
aio_nr_sub(ctx->max_reqs);
err:
- aio_free_ring(ctx);
free_percpu(ctx->cpu);
free_percpu(ctx->reqs.pcpu_count);
free_percpu(ctx->users.pcpu_count);
Patches currently in stable-queue which might be from sasha.levin@xxxxxxxxxx are
queue-3.12/aio-prevent-double-free-in-ioctx_alloc.patch
queue-3.12/aio-nullify-aio-ring_pages-after-freeing-it.patch
queue-3.12/video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html