diff options
author | Kent Overstreet | 2024-03-31 17:52:12 -0400 |
---|---|---|
committer | Christian Brauner | 2024-04-05 11:20:28 +0200 |
commit | caeb4b0a11b3393e43f7fa8e0a5a18462acc66bd (patch) | |
tree | 4da15d8b35f3fc59a96524eb7aa55852f87fe98f /include/linux | |
parent | 22650a99821dda3d05f1c334ea90330b4982de56 (diff) |
aio: Fix null ptr deref in aio_complete() wakeup
list_del_init_careful() needs to be the last access to the wait queue
entry - it effectively unlocks access.
Previously, finish_wait() would see the empty list head and skip taking
the lock, and then we'd return - but the completion path would still
attempt to do the wakeup after the task_struct pointer had been
overwritten.
Fixes: 71eb6b6b0ba9 ("fs/aio: obey min_nr when doing wakeups")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-fsdevel/CAHTA-ubfwwB51A5Wg5M6H_rPEQK9pNf8FkAGH=vr=FEkyRrtqw@mail.gmail.com/
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Link: https://lore.kernel.org/stable/20240331215212.522544-1-kent.overstreet%40linux.dev
Link: https://lore.kernel.org/r/20240331215212.522544-1-kent.overstreet@linux.dev
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions