Al Viro 914812331d fix io_destroy()/aio_complete() race ...

commit 4faa99965e upstream.

If io_destroy() gets to cancelling everything that can be cancelled and
gets to kiocb_cancel() calling the function driver has left in ->ki_cancel,
it becomes vulnerable to a race with IO completion.  At that point req
is already taken off the list and aio_complete() does *NOT* spin until
we (in free_ioctx_users()) releases ->ctx_lock.  As the result, it proceeds
to kiocb_free(), freing req just it gets passed to ->ki_cancel().

Fix is simple - remove from the list after the call of kiocb_cancel().  All
instances of ->ki_cancel() already have to cope with the being called with
iocb still on list - that's what happens in io_cancel(2).

Cc: stable@kernel.org
Fixes: 0460fef2a9 "aio: use cancellation list lazily"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-06-06 16:46:23 +02:00

..

9p

fs/9p: Compare qid.path in v9fs_test_inode

2017-11-30 08:37:22 +00:00

adfs

…

affs

affs_lookup(): close a race with affs_remove_link()

2018-05-30 07:48:51 +02:00

afs

afs: Fix afs_kill_pages()

2017-12-20 10:04:56 +01:00

autofs4

autofs: mount point create should honour passed in mode

2018-04-24 09:32:11 +02:00

befs

…

bfs

…

btrfs

btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers

2018-05-30 07:49:09 +02:00

cachefiles

FS-Cache: Add missing initialization of ret in cachefiles_write_page()

2015-11-16 20:38:43 -05:00

ceph

ceph: drop negative child dentries before try pruning inode's alias

2017-12-20 10:04:52 +01:00

cifs

cifs: silence compiler warnings showing up with gcc-8.0.0

2018-05-30 07:48:56 +02:00

coda

coda: fix 'kernel memory exposure attempt' in fsync

2017-11-24 08:32:25 +01:00

configfs

configfs: Fix race between create_link and configfs_rmdir

2017-06-26 07:13:08 +02:00

cramfs

…

debugfs

dentry name snapshots

2017-08-06 19:19:42 -07:00

devpts

devpts: clean up interface to pty drivers

2016-08-16 09:30:49 +02:00

dlm

dlm: avoid double-free on error path in dlm_device_{register,unregister}

2017-09-13 14:09:45 -07:00

ecryptfs

do d_instantiate/unlock_new_inode combinations safely

2018-05-30 07:48:52 +02:00

efivarfs

efi: Make efivarfs entries immutable by default

2016-03-03 15:07:09 -08:00

efs

…

exofs

osd fs: __r4w_get_page rely on PageUptodate for uptodate

2015-12-12 10:15:34 -08:00

exportfs

…

ext2

do d_instantiate/unlock_new_inode combinations safely

2018-05-30 07:48:52 +02:00

ext4

do d_instantiate/unlock_new_inode combinations safely

2018-05-30 07:48:52 +02:00

f2fs

do d_instantiate/unlock_new_inode combinations safely

2018-05-30 07:48:52 +02:00

fat

fat: fix using uninitialized fields of fat_inode/fsinfo_inode

2017-03-15 09:57:15 +08:00

freevxfs

freevxfs: Grammar s/an negative/a negative/

2015-08-07 13:59:24 +02:00

fscache

fscache: Fix hanging wait on page discarded by writeback

2018-05-30 07:49:08 +02:00

fuse

fuse: fix READDIRPLUS skipping an entry

2017-11-02 09:40:49 +01:00

gfs2

gfs2: Fix fallocate chunk size

2018-05-30 07:49:13 +02:00

hfs

hfs: fix B-tree corruption after insertion at position 0

2015-09-10 13:29:01 -07:00

hfsplus

hfsplus: stop workqueue when fill_super() failed

2018-05-26 08:49:01 +02:00

hostfs

hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()

2016-09-30 10:18:39 +02:00

hpfs

hpfs: implement the show_options method

2016-06-01 12:15:54 -07:00

hugetlbfs

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

isofs

isofs: fix timestamps beyond 2027

2017-11-30 08:37:20 +00:00

jbd2

ext4: set h_journal if there is a failure starting a reserved handle

2018-05-02 07:53:38 -07:00

jffs2

jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path

2018-05-30 07:48:54 +02:00

jfs

do d_instantiate/unlock_new_inode combinations safely

2018-05-30 07:48:52 +02:00

kernfs

kernfs: fix regression in kernfs_fop_write caused by wrong type

2018-02-16 20:09:42 +01:00

lockd

lockd: lost rollback of set_grace_period() in lockd_down_net()

2018-05-26 08:48:50 +02:00

logfs

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

minix

…

ncpfs

staging: ncpfs: memory corruption in ncp_read_kernel()

2018-03-28 18:40:15 +02:00

nfs

nfs: Do not convert nfs_idmap_cache_timeout to jiffies

2018-05-30 07:48:53 +02:00

nfs_common

lockd: fix "list_add double add" caused by legacy signal interface

2018-02-03 17:04:28 +01:00

nfsd

nfsd4: permit layoutget of executable-only files

2018-03-24 10:58:48 +01:00

nilfs2

do d_instantiate/unlock_new_inode combinations safely

2018-05-30 07:48:52 +02:00

nls

…

notify

fanotify: fix logic of events on child

2018-04-24 09:32:11 +02:00

ntfs

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

ocfs2

ocfs2/dlm: don't handle migrate lockres if already in shutdown

2018-05-30 07:49:08 +02:00

omfs

…

openpromfs

…

overlayfs

ovl: filter trusted xattr for non-admin

2018-04-13 19:50:14 +02:00

proc

fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table

2018-05-30 07:49:07 +02:00

pstore

pstore: Use dynamic spinlock initializer

2017-08-06 19:19:43 -07:00

qnx4

…

qnx6

…

quota

quota: Check for register_shrinker() failure.

2018-02-03 17:04:28 +01:00

ramfs

mm, fs: obey gfp_mapping for add_to_page_cache()

2015-10-16 11:42:28 -07:00

reiserfs

do d_instantiate/unlock_new_inode combinations safely

2018-05-30 07:48:52 +02:00

romfs

romfs: use different way to generate fsid for BLOCK or MTD

2017-06-17 06:39:38 +02:00

squashfs

squashfs: xattr simplifications

2015-11-13 20:34:33 -05:00

sysfs

sysfs: be careful of error returns from ops->show()

2017-04-12 12:38:33 +02:00

sysv

fix sysvfs symlinks

2015-11-23 21:11:08 -05:00

tracefs

tracefs: Fix refcount imbalance in start_creating()

2015-11-04 22:13:45 -05:00

ubifs

ubifs: Check ubifs_wbuf_sync() return code

2018-04-24 09:32:05 +02:00

udf

udf: Provide saner default for invalid uid / gid

2018-05-30 07:49:15 +02:00

ufs

do d_instantiate/unlock_new_inode combinations safely

2018-05-30 07:48:52 +02:00

xfs

xfs: detect agfl count corruption and reset agfl

2018-06-06 16:46:20 +02:00

aio.c

fix io_destroy()/aio_complete() race

2018-06-06 16:46:23 +02:00

anon_inodes.c

…

attr.c

vfs: move permission checking into notify_change() for utimes(NULL)

2016-10-22 12:26:56 +02:00

bad_inode.c

…

binfmt_aout.c

…

binfmt_elf_fdpic.c

Merge tag 'libnvdimm-for-4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

2015-11-10 12:07:22 -08:00

binfmt_elf.c

binfmt_elf: use ELF_ET_DYN_BASE only for PIE

2017-07-21 07:44:57 +02:00

binfmt_em86.c

…

binfmt_flat.c

…

binfmt_misc.c

…

binfmt_script.c

…

block_dev.c

fs/block_dev: always invalidate cleancache in invalidate_bdev()

2017-05-20 14:27:01 +02:00

buffer.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

char_dev.c

fs/char_dev.c: fix incorrect documentation for unregister_chrdev_region

2015-08-05 13:49:35 -07:00

compat_binfmt_elf.c

binfmt_elf: compat: avoid unused function warning

2018-02-25 11:03:51 +01:00

compat_ioctl.c

fs: compat: Remove warning from COMPATIBLE_IOCTL

2018-04-08 11:51:57 +02:00

compat.c

…

coredump.c

coredump: Ensure proper size of sparse core files

2017-07-05 14:37:20 +02:00

dax.c

dax: disable pmd mappings

2015-11-16 23:54:45 -08:00

dcache.c

do d_instantiate/unlock_new_inode combinations safely

2018-05-30 07:48:52 +02:00

dcookies.c

…

direct-io.c

direct-io: Prevent NULL pointer access in submit_page_section

2017-10-18 09:20:42 +02:00

drop_caches.c

inode: convert inode_sb_list_lock to per-sb

2015-08-17 18:39:46 -04:00

eventfd.c

…

eventpoll.c

epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()

2017-09-07 08:34:10 +02:00

exec.c

exec: Limit arg stack to at most 75% of _STK_LIM

2017-07-21 07:44:57 +02:00

fcntl.c

fs/fcntl: f_setown, avoid undefined behaviour

2018-01-31 12:06:11 +01:00

fhandle.c

fs/coredump: prevent fsuid=0 dumps into user-controlled directories

2016-04-12 09:08:58 -07:00

file_table.c

fs, file table: reinit files_stat.max_files after deferred memory initialisation

2015-08-07 04:39:40 +03:00

file.c

vfs: clear remainder of 'full_fds_bits' in dup_fd()

2015-11-05 23:05:32 -08:00

filesystems.c

…

fs_pin.c

…

fs_struct.c

…

fs-writeback.c

bdi: Fix oops in wb_workfn()

2018-05-16 10:06:51 +02:00

inode.c

don't put symlink bodies in pagecache into highmem

2018-02-16 20:09:38 +01:00

internal.h

inode: rename i_wb_list to i_io_list

2015-08-17 23:38:10 -04:00

ioctl.c

…

Kconfig

dax: disable pmd mappings

2015-11-16 23:54:45 -08:00

Kconfig.binfmt

…

libfs.c

fs: Set the size of empty dirs to 0.

2015-08-12 15:28:45 -05:00

locks.c

locks: don't check for race with close when setting OFD lock

2018-01-17 09:35:27 +01:00

Makefile

ext4: promote ext4 over ext2 in the default probe order

2015-10-15 10:33:21 -04:00

mbcache.c

…

mount.h

mnt: In propgate_umount handle visiting mounts in any order

2017-07-21 07:44:57 +02:00

mpage.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

namei.c

getname_kernel() needs to make sure that ->name != ->iname in long case

2018-04-24 09:32:04 +02:00

namespace.c

Don't leak MNT_INTERNAL away from internal mounts

2018-04-24 09:32:11 +02:00

no-block.c

…

nsfs.c

nsfs: mark dentry with DCACHE_RCUACCESS

2018-02-16 20:09:43 +01:00

open.c

fs: completely ignore unknown open flags

2017-07-15 11:57:44 +02:00

pipe.c

pipe: cap initial pipe capacity according to pipe-max-size limit

2018-05-26 08:48:51 +02:00

pnode.c

mnt: Make propagate_umount less slow for overlapping mount propagation trees

2017-07-21 07:44:58 +02:00

pnode.h

mnt: Add a per mount namespace limit on the number of mounts

2017-04-30 05:49:28 +02:00

posix_acl.c

tmpfs: clear S_ISGID when setting posix ACLs

2017-01-26 08:23:47 +01:00

proc_namespace.c

vfs: show_vfsstat: do not ignore errors from show_devname method

2016-04-12 09:08:55 -07:00

read_write.c

vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets

2017-10-05 09:41:45 +02:00

readdir.c

…

select.c

fs/select: add vmalloc fallback for select(2)

2018-01-31 12:06:09 +01:00

seq_file.c

Make file credentials available to the seqfile interfaces

2017-08-06 19:19:42 -07:00

signalfd.c

signalfd: fix information leak in signalfd_copyinfo

2015-08-07 04:39:40 +03:00

splice.c

vfs: fix uninitialized flags in splice_to_pipe()

2017-02-23 17:43:09 +01:00

stack.c

…

stat.c

ufs: restore maintaining ->i_blocks

2017-06-14 13:16:24 +02:00

statfs.c

…

super.c

sget(): handle failures of register_shrinker()

2018-03-03 10:19:41 +01:00

sync.c

fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback

2015-11-06 17:50:42 -08:00

timerfd.c

timerfd: Protect the might cancel mechanism proper

2017-05-08 07:46:01 +02:00

userfaultfd.c

userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE

2017-12-20 10:04:53 +01:00

utimes.c

vfs: move permission checking into notify_change() for utimes(NULL)

2016-10-22 12:26:56 +02:00

xattr.c

lsm: fix smack_inode_removexattr and xattr_getsecurity memleak

2017-10-12 11:27:32 +02:00