You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Tejun Heo 4c81f045c0 ext4: fix racy use-after-free in ext4_end_io_dio() ... ext4_end_io_dio() queues io_end->work and then clears iocb->private; however, io_end->work calls aio_complete() which frees the iocb object. If that slab object gets reallocated, then ext4_end_io_dio() can end up clearing someone else's iocb->private, this use-after-free can cause a leak of a struct ext4_io_end_t structure. Detected and tested with slab poisoning. [ Note: Can also reproduce using 12 fio's against 12 file systems with the following configuration file: [global] direct=1 ioengine=libaio iodepth=1 bs=4k ba=4k size=128m [create] filename=${TESTDIR} rw=write -- tytso ] Google-Bug-Id: 5354697 Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Reported-by: Kent Overstreet <koverstreet@google.com> Tested-by: Kent Overstreet <koverstreet@google.com> Cc: stable@kernel.org		13 years ago
..
Kconfig	ext4: Don't ask about supporting ext2/3 in ext4 if ext4 is not configured	15 years ago
Makefile	ext4: move ext4_ind_* functions from inode.c to indirect.c	14 years ago
acl.c	switch posix_acl_equiv_mode() to umode_t *	14 years ago
acl.h	fs: take the ACL checks to common code	14 years ago
balloc.c	ext4: fix up a undefined error in ext4_free_blocks in debugging code	13 years ago
bitmap.c	…
block_validity.c	ext4: move ext4_ind_* functions from inode.c to indirect.c	14 years ago
dir.c	ext4: Use ext4_error_file() to print the pathname to the corrupted inode	14 years ago
ext4.h	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4	13 years ago
ext4_extents.h	ext4: Fix bigalloc quota accounting and i_blocks value	14 years ago
ext4_jbd2.c	jbd2: add debugging information to jbd2_journal_dirty_metadata()	14 years ago
ext4_jbd2.h	ext4: Fix ext4_should_writeback_data() for no-journal mode	14 years ago
extents.c	ext4: let ext4_ext_rm_leaf work with EXT_DEBUG defined	13 years ago
file.c	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4	13 years ago
fsync.c	ext4: optimize locking for end_io extent conversion	13 years ago
hash.c	…
ialloc.c	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/hch/vfs-queue	13 years ago
indirect.c	ext4: enforce bigalloc restrictions (e.g., no online resizing, etc.)	14 years ago
inode.c	ext4: fix racy use-after-free in ext4_end_io_dio()	13 years ago
ioctl.c	ext4: add __user decoration to calls of copy_{from,to}_user()	13 years ago
mballoc.c	ext4: fix a wrong comment in __mb_check_buddy()	13 years ago
mballoc.h	ext4: fix a typo in struct ext4_allocation_context	13 years ago
migrate.c	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/hch/vfs-queue	13 years ago
mmp.c	ext4: Fix comparison endianness problem in MMP initialization	13 years ago
move_extent.c	ext4: add some tracepoints in ext4/extents.c	14 years ago
namei.c	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/hch/vfs-queue	13 years ago
page-io.c	ext4: Create helper function for EXT4_IO_END_UNWRITTEN and i_aiodio_unwritten	13 years ago
resize.c	ext4: Rename ext4_free_blks_{count,set}() to refer to clusters	14 years ago
super.c	ext4: Remove kernel_lock annotations	13 years ago
symlink.c	ext4: symlink must be handled via filesystem specific operation	15 years ago
truncate.h	ext4: move common truncate functions to header file	14 years ago
xattr.c	ext4: fix race in xattr block allocation path	13 years ago
xattr.h	fs/vfs/security: pass last path component to LSM on inode creation	14 years ago
xattr_security.c	security: new security_inode_init_security API adds function callback	14 years ago
xattr_trusted.c	ext4: constify xattr_handler	15 years ago
xattr_user.c	ext4: constify xattr_handler	15 years ago