block/loop: fix use after free

Browse source

lo_rw_aio->call_read_iter->
1       aops->direct_IO
2       iov_iter_revert
lo_rw_aio_complete could happen between 1 and 2, the bio and bvec could
be freed before 2, which accesses bvec.

Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

...

This commit is contained in:

Shaohua Li 2017-09-01 11:15:17 -07:00 • committed by Jens Axboe

parent 12cd3a2fe3

commit 92d773324b

2 changed files with 17 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

16

drivers/block/loop.c

View file

5

drivers/block/loop.h

View file