raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-07 02:19:54 +00:00
Code Issues Projects Releases Wiki Activity
Files
c34dfee464b5243bc0f10e0b51a50874429ee5c2
linux/fs
History
Al Viro 3035e187f3 fix io_destroy()/aio_complete() race 
commit 4faa99965e upstream.

If io_destroy() gets to cancelling everything that can be cancelled and
gets to kiocb_cancel() calling the function driver has left in ->ki_cancel,
it becomes vulnerable to a race with IO completion.  At that point req
is already taken off the list and aio_complete() does *NOT* spin until
we (in free_ioctx_users()) releases ->ctx_lock.  As the result, it proceeds
to kiocb_free(), freing req just it gets passed to ->ki_cancel().

Fix is simple - remove from the list after the call of kiocb_cancel().  All
instances of ->ki_cancel() already have to cope with the being called with
iocb still on list - that's what happens in io_cancel(2).

Cc: stable@kernel.org
Fixes: 0460fef2a9 "aio: use cancellation list lazily"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-05 11:46:14 +02:00
..
9p
fs/*/Kconfig: drop links to 404-compliant http://acl.bestbits.at
2018-01-01 12:45:37 -07:00
adfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
affs
affs_lookup(): close a race with affs_remove_link()
2018-05-30 08:17:14 +02:00
afs
afs: Support the AFS dynamic root
2018-02-06 14:43:37 +00:00
autofs4
autofs: mount point create should honour passed in mode
2018-04-24 09:43:10 +02:00
befs
befs: Define usercopy region in befs_inode_cache slab cache
2018-01-15 12:07:54 -08:00
bfs
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
btrfs
btrfs: fix null pointer deref when target device is missing
2018-05-30 08:17:29 +02:00
cachefiles
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
ceph
ceph: fix rsize/wsize capping in ceph_direct_read_write()
2018-05-16 10:12:30 +02:00
cifs
smb3: directory sync should not return an error
2018-05-16 10:12:35 +02:00
coda
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
configfs
configfs: make ci_type field, some pointers and function arguments const
2017-10-19 16:15:16 +02:00
cramfs
cramfs: better MTD dependency expression
2018-02-08 11:37:31 -08:00
crypto
fscrypt: fix build with pre-4.6 gcc versions
2018-02-01 10:51:18 -05:00
debugfs
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
devpts
devpts: fix error handling in devpts_mntget()
2018-01-31 08:48:37 -08:00
dlm
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
ecryptfs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 08:17:15 +02:00
efivarfs
efivarfs: Limit the rate for non-root to read files
2018-02-22 10:21:02 -08:00
efs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
exofs
Merge tag 'iversion-v4.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux
2018-02-07 14:25:22 -08:00
exportfs
…
ext2
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 08:17:15 +02:00
ext4
ext4: don't complain about incorrect features when probing
2018-05-30 08:17:30 +02:00
f2fs
f2fs: fix to check extent cache in f2fs_drop_extent_tree
2018-05-30 08:17:35 +02:00
fat
iversion: Rename make inode_cmp_iversion{+raw} to inode_eq_iversion{+raw}
2018-02-01 08:15:25 -05:00
freevxfs
vxfs: Define usercopy region in vxfs_inode slab cache
2018-01-15 12:07:57 -08:00
fscache
fscache: Fix hanging wait on page discarded by writeback
2018-05-30 08:17:23 +02:00
fuse
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
gfs2
gfs2: Fix fallocate chunk size
2018-05-30 08:17:37 +02:00
hfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
hfsplus
hfsplus: stop workqueue when fill_super() failed
2018-05-25 16:46:11 +02:00
hostfs
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
hpfs
hpfs: don't bother with the i_version counter or f_version
2017-12-10 12:58:18 -08:00
hugetlbfs
hugetlbfs: fix bug in pgoff overflow checking
2018-04-19 08:54:09 +02:00
isofs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
jbd2
ext4: set h_journal if there is a failure starting a reserved handle
2018-05-01 12:47:18 -07:00
jffs2
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 08:17:15 +02:00
jfs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 08:17:15 +02:00
kernfs
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
lockd
lockd: Fix server refcounting
2018-01-24 17:33:57 -05:00
minix
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
nfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-03-15 18:57:14 -07:00
nfs_common
lockd: fix "list_add double add" caused by legacy signal interface
2017-11-27 16:45:11 -05:00
nfsd
nfsd: fix incorrect umasks
2018-04-19 08:54:10 +02:00
nilfs2
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 08:17:15 +02:00
nls
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
notify
fanotify: fix logic of events on child
2018-04-24 09:43:09 +02:00
ntfs
ntfs: remove i_version handling
2018-01-01 10:09:33 -05:00
ocfs2
ocfs2/dlm: don't handle migrate lockres if already in shutdown
2018-05-30 08:17:23 +02:00
omfs
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
openpromfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
orangefs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 08:17:15 +02:00
overlayfs
ovl: set lower layer st_dev only if setting lower st_ino
2018-04-19 08:54:09 +02:00
proc
fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table
2018-05-30 08:17:20 +02:00
pstore
fs: pstore: remove unused hardirq.h
2017-11-28 16:39:09 -08:00
qnx4
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
qnx6
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
quota
quota: Check for register_shrinker() failure.
2017-11-29 16:46:48 +01:00
ramfs
mm: make pagevec_lookup() update index
2017-09-06 17:27:26 -07:00
reiserfs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 08:17:15 +02:00
romfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
squashfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
sysfs
sysfs: symlink: export sysfs_create_link_nowarn()
2018-03-19 21:14:26 -04:00
sysv
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
tracefs
…
ubifs
ubifs: Check ubifs_wbuf_sync() return code
2018-04-24 09:42:48 +02:00
udf
udf: Provide saner default for invalid uid / gid
2018-05-30 08:17:41 +02:00
ufs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 08:17:15 +02:00
xfs
xfs: detect agfl count corruption and reset agfl
2018-06-05 11:46:10 +02:00
aio.c
fix io_destroy()/aio_complete() race
2018-06-05 11:46:14 +02:00
anon_inodes.c
…
attr.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
bad_inode.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
binfmt_aout.c
fs: fix kernel_read prototype
2017-09-04 19:05:15 -04:00
binfmt_elf_fdpic.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:54:01 -08:00
binfmt_elf.c
elf: fix NT_FILE integer overflow
2018-02-06 18:32:45 -08:00
binfmt_em86.c
…
binfmt_flat.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
binfmt_misc.c
fs/binfmt_misc.c: node could be NULL when evicting inode
2017-10-13 16:18:33 -07:00
binfmt_script.c
exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array
2017-10-03 17:54:25 -07:00
block_dev.c
blockdev: Avoid two active bdev inodes for one device
2018-02-26 09:48:42 -07:00
buffer.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-31 09:25:20 -08:00
char_dev.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
compat_binfmt_elf.c
…
compat_ioctl.c
fs: compat_ioctl: add new DVB demux ioctls
2017-12-28 11:17:29 -05:00
compat.c
…
coredump.c
Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 11:54:55 -08:00
dax.c
Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
2018-02-03 13:49:22 -08:00
dcache.c
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 08:17:15 +02:00
dcookies.c
…
direct-io.c
direct-io: Fix sleep in atomic due to sync AIO
2018-02-26 09:05:35 -07:00
drop_caches.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
eventfd.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
eventpoll.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
exec.c
exec: Weaken dumpability for secureexec
2018-01-03 10:13:36 -08:00
fcntl.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
fhandle.c
vfs: Copy struct mount.mnt_id to userspace using put_user()
2018-01-15 12:07:51 -08:00
file_table.c
vfs: remove unused hardirq.h
2017-12-07 14:23:30 -05:00
file.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-31 09:25:20 -08:00
filesystems.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
fs_pin.c
Merge branch 'linus' into locking/core, to resolve conflicts
2017-11-07 10:32:44 +01:00
fs_struct.c
…
fs-writeback.c
bdi: Fix oops in wb_workfn()
2018-05-16 10:12:28 +02:00
inode.c
vfs: remove might_sleep() from clear_inode()
2018-02-06 18:32:47 -08:00
internal.h
fs: expose do_unlinkat for built-in callers
2017-11-10 08:48:46 -05:00
ioctl.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
iomap.c
iomap: warn on zero-length mappings
2018-01-29 07:27:24 -08:00
Kconfig
Merge tag 'libnvdimm-for-4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2018-02-06 10:41:33 -08:00
Kconfig.binfmt
ARM: enable elf_fdpic on systems with an MMU
2017-09-10 19:31:46 -04:00
libfs.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
locks.c
Merge tag 'nfsd-4.16' of git://linux-nfs.org/~bfields/linux
2018-02-08 15:18:32 -08:00
Makefile
ncpfs: move net/ncpfs to drivers/staging/ncpfs
2017-11-28 13:55:01 +01:00
mbcache.c
mbcache: make sure c_entry_count is not decremented past zero
2018-01-09 23:57:52 -05:00
mount.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mpage.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
namei.c
getname_kernel() needs to make sure that ->name != ->iname in long case
2018-04-19 08:54:12 +02:00
namespace.c
Don't leak MNT_INTERNAL away from internal mounts
2018-04-24 09:43:10 +02:00
no-block.c
…
nsfs.c
nsfs: generalize ns_get_path() for path resolution with a task
2017-12-31 16:12:23 +01:00
open.c
ovl: don't allow writing ioctl on lower layer
2017-09-05 12:53:12 +02:00
pipe.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
pnode.c
…
pnode.h
…
posix_acl.c
posix_acl: convert posix_acl.a_refcount from atomic_t to refcount_t
2018-01-02 19:27:28 -08:00
proc_namespace.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
read_write.c
Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:08:18 -08:00
readdir.c
Merge branch 'linus' into locking/core, to resolve conflicts
2017-11-07 10:32:44 +01:00
select.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
seq_file.c
seq_file: fix incomplete reset on read from zero offset
2018-01-20 02:31:15 -05:00
signalfd.c
fs/signalfd: fix build error for BUS_MCEERR_AR
2018-02-22 15:00:07 -06:00
splice.c
locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE()
2017-10-25 11:01:08 +02:00
stack.c
…
stat.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
statfs.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
super.c
fs: don't scan the inode cache before SB_BORN is set
2018-05-30 08:17:15 +02:00
sync.c
Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block
2017-11-14 15:32:19 -08:00
timerfd.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
userfaultfd.c
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
utimes.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
xattr.c
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
2017-10-04 18:03:15 +11:00