Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1511865
| From | Linus Torvalds <torvalds@linux-foundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) |
| Date | 2016-10-29 21:10 +0200 |
| Message-ID | <sxHaV-29g-11@gated-at.bofh.it> (permalink) |
| References | (1 earlier) <sxwyR-3dk-1@gated-at.bofh.it> <sxAVP-6bh-9@gated-at.bofh.it> <sxDK1-7WB-17@gated-at.bofh.it> <sxFVv-1aY-1@gated-at.bofh.it> <sxH1f-1QO-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Sat, Oct 29, 2016 at 11:52 AM, Al Viro <viro@zeniv.linux.org.uk> wrote:
>
> And that call can happen as soon as we return from __blockdev_direct_IO()
> (even earlier, actually). As soon as that happens, the reference to
> struct file we'd acquired in io_submit_one() is dropped. If descriptor
> table had been shared, another thread might have already closed that sucker,
> and fput() from aio_complete() would free struct file.
But that's the point. We don't *do* anything like that any more. We
now always do the final access from aio_complete(). So it doesn't
matter if that is called asynchronously (very early) or not.
That's the whole point of the patch. Exactly to do everything either
*before* we even submit it (at which point no completion can happen),
or doing it in aio_complete() which is guaranteed to be after the
submission. No races, no use-after-free.
What am I missing?
Linus
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-29 09:50 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 14:30 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-29 17:30 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 18:20 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 18:40 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-30 07:40 +0100
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-29 19:50 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 21:00 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-29 21:10 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Al Viro <viro@ZenIV.linux.org.uk> - 2016-10-29 21:20 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Linus Torvalds <torvalds@linux-foundation.org> - 2016-10-29 22:10 +0200
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Jan Kara <jack@suse.cz> - 2016-10-30 10:50 +0100
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Jan Kara <jack@suse.cz> - 2016-10-30 12:00 +0100
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-30 17:00 +0100
Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) Christoph Hellwig <hch@lst.de> - 2016-10-30 07:40 +0100
csiph-web