ext4: fix racy use-after-free in ext4_end_io_dio()
authorTejun Heo <tj@kernel.org>
Fri, 25 Nov 2011 00:22:24 +0000 (19:22 -0500)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 9 Dec 2011 16:54:18 +0000 (08:54 -0800)
commit01da30a885baa667801facc2a54c80346ab6c414
tree9c56a582bdb26fb0ee11f8eac4f56d4f6e6bfbab
parent453fdf5561cc042b7e127af6a62138969726f539
ext4: fix racy use-after-free in ext4_end_io_dio()

commit 4c81f045c0bd2cbb78cc6446a4cd98038fe11a2e upstream.

ext4_end_io_dio() queues io_end->work and then clears iocb->private;
however, io_end->work calls aio_complete() which frees the iocb
object.  If that slab object gets reallocated, then ext4_end_io_dio()
can end up clearing someone else's iocb->private, this use-after-free
can cause a leak of a struct ext4_io_end_t structure.

Detected and tested with slab poisoning.

[ Note: Can also reproduce using 12 fio's against 12 file systems with the
  following configuration file:

  [global]
  direct=1
  ioengine=libaio
  iodepth=1
  bs=4k
  ba=4k
  size=128m

  [create]
  filename=${TESTDIR}
  rw=write

  -- tytso ]

Google-Bug-Id: 5354697
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reported-by: Kent Overstreet <koverstreet@google.com>
Tested-by: Kent Overstreet <koverstreet@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fs/ext4/inode.c