From: Eric Biggers <ebiggers@kernel.org>
To: Alexander Viro <viro@zeniv.linux.org.uk>,
Benjamin LaHaise <bcrl@kvack.org>
Cc: linux-aio@kvack.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, Ramji Jiyani <ramjiyani@google.com>,
Christoph Hellwig <hch@lst.de>,
Linus Torvalds <torvalds@linux-foundation.org>,
Oleg Nesterov <oleg@redhat.com>, Jens Axboe <axboe@kernel.dk>,
stable@vger.kernel.org
Subject: [PATCH 0/2] aio poll: fix use-after-free and missing wakeups
Date: Fri, 3 Dec 2021 16:22:59 -0800 [thread overview]
Message-ID: <20211204002301.116139-1-ebiggers@kernel.org> (raw)
This series fixes some bugs in aio poll. This is intended to replace
"[PATCH v5] aio: Add support for the POLLFREE"
(https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)
which has some bugs.
Careful review is appreciated; this code is very hard to work with, and
I don't know of an easy way to test it.
Note, it looks like io_uring has these same bugs too. I haven't tried
to fix io_uring.
This applies to v5.16-rc3.
Eric Biggers (2):
aio: keep poll requests on waitqueue until completed
aio: fix use-after-free due to missing POLLFREE handling
fs/aio.c | 138 +++++++++++++++++++++++++-------
include/uapi/asm-generic/poll.h | 2 +-
2 files changed, 111 insertions(+), 29 deletions(-)
base-commit: d58071a8a76d779eedab38033ae4c821c30295a5
--
2.34.1
next reply other threads:[~2021-12-04 0:23 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-04 0:22 Eric Biggers [this message]
2021-12-04 0:23 ` [PATCH 1/2] aio: keep poll requests on waitqueue until completed Eric Biggers
2021-12-06 18:56 ` Eric Biggers
2021-12-04 0:23 ` [PATCH 2/2] aio: fix use-after-free due to missing POLLFREE handling Eric Biggers
2021-12-06 19:28 ` Linus Torvalds
2021-12-06 19:54 ` Eric Biggers
2021-12-06 21:48 ` Linus Torvalds
2021-12-07 10:21 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211204002301.116139-1-ebiggers@kernel.org \
--to=ebiggers@kernel.org \
--cc=axboe@kernel.dk \
--cc=bcrl@kvack.org \
--cc=hch@lst.de \
--cc=linux-aio@kvack.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=ramjiyani@google.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.