LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Christoph Hellwig <hch@lst.de>
Cc: Avi Kivity <avi@scylladb.com>,
	linux-aio@kvack.org, linux-fsdevel@vger.kernel.org,
	netdev@vger.kernel.org, linux-api@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 10/32] aio: implement IOCB_CMD_POLL
Date: Sun, 20 May 2018 06:32:25 +0100	[thread overview]
Message-ID: <20180520053219.GZ30522@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20180515194833.6906-11-hch@lst.de>

On Tue, May 15, 2018 at 09:48:11PM +0200, Christoph Hellwig wrote:
> +static ssize_t aio_poll(struct aio_kiocb *aiocb, struct iocb *iocb)
> +{
> +	struct kioctx *ctx = aiocb->ki_ctx;
> +	struct poll_iocb *req = &aiocb->poll;
> +	unsigned long flags;
> +	__poll_t mask;
> +
> +	/* reject any unknown events outside the normal event mask. */
> +	if ((u16)iocb->aio_buf != iocb->aio_buf)
> +		return -EINVAL;
> +	/* reject fields that are not defined for poll */
> +	if (iocb->aio_offset || iocb->aio_nbytes || iocb->aio_rw_flags)
> +		return -EINVAL;
> +
> +	req->events = demangle_poll(iocb->aio_buf) | POLLERR | POLLHUP;
> +	req->file = fget(iocb->aio_fildes);
> +	if (unlikely(!req->file))
> +		return -EBADF;
> +	if (!file_has_poll_mask(req->file))
> +		goto out_fail;
> +
> +	req->head = req->file->f_op->get_poll_head(req->file, req->events);
> +	if (!req->head)
> +		goto out_fail;
> +	if (IS_ERR(req->head)) {
> +		mask = EPOLLERR;
> +		goto done;
> +	}
> +
> +	init_waitqueue_func_entry(&req->wait, aio_poll_wake);
> +	aiocb->ki_cancel = aio_poll_cancel;
> +
> +	spin_lock_irqsave(&ctx->ctx_lock, flags);
> +	list_add_tail(&aiocb->ki_list, &ctx->delayed_cancel_reqs);
> +	spin_unlock(&ctx->ctx_lock);

... and io_cancel(2) comes, finds it and inhume^Wcompletes it, leaving us to...

> +	spin_lock(&req->head->lock);

... get buggered on attempt to dereference a pointer fetched from freed and
reused object.

  reply	other threads:[~2018-05-20  5:33 UTC|newest]

Thread overview: 39+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-15 19:48 aio poll and a new in-kernel poll API V11 Christoph Hellwig
2018-05-15 19:48 ` [PATCH 01/32] fs: unexport poll_schedule_timeout Christoph Hellwig
2018-05-15 19:48 ` [PATCH 02/32] fs: cleanup do_pollfd Christoph Hellwig
2018-05-15 19:48 ` [PATCH 03/32] fs: update documentation to mention __poll_t and match the code Christoph Hellwig
2018-05-15 19:48 ` [PATCH 04/32] fs: add new vfs_poll and file_can_poll helpers Christoph Hellwig
2018-05-15 19:48 ` [PATCH 05/32] fs: introduce new ->get_poll_head and ->poll_mask methods Christoph Hellwig
2018-05-15 19:48 ` [PATCH 06/32] aio: simplify KIOCB_KEY handling Christoph Hellwig
2018-05-15 19:48 ` [PATCH 07/32] aio: simplify cancellation Christoph Hellwig
2018-05-15 19:48 ` [PATCH 08/32] aio: replace kiocb_set_cancel_fn with a cancel_kiocb file operation Christoph Hellwig
2018-05-20  5:27   ` Al Viro
2018-05-15 19:48 ` [PATCH 09/32] aio: add delayed cancel support Christoph Hellwig
2018-05-15 19:48 ` [PATCH 10/32] aio: implement IOCB_CMD_POLL Christoph Hellwig
2018-05-20  5:32   ` Al Viro [this message]
2018-05-20  7:33     ` Al Viro
2018-05-20 17:32       ` Christoph Hellwig
2018-05-15 19:48 ` [PATCH 11/32] net: refactor socket_poll Christoph Hellwig
2018-05-15 19:48 ` [PATCH 12/32] net: add support for ->poll_mask in proto_ops Christoph Hellwig
2018-05-15 19:48 ` [PATCH 13/32] net: remove sock_no_poll Christoph Hellwig
2018-05-15 19:48 ` [PATCH 14/32] net/tcp: convert to ->poll_mask Christoph Hellwig
2018-05-15 19:48 ` [PATCH 15/32] net/unix: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 16/32] net: convert datagram_poll users tp ->poll_mask Christoph Hellwig
2018-05-15 19:48 ` [PATCH 17/32] net/dccp: convert to ->poll_mask Christoph Hellwig
2018-05-15 19:48 ` [PATCH 18/32] net/atm: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 19/32] net/vmw_vsock: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 20/32] net/tipc: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 21/32] net/sctp: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 22/32] net/bluetooth: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 23/32] net/caif: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 24/32] net/nfc: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 25/32] net/phonet: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 26/32] net/iucv: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 27/32] net/rxrpc: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 28/32] crypto: af_alg: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 29/32] pipe: " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 30/32] eventfd: switch " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 31/32] timerfd: convert " Christoph Hellwig
2018-05-15 19:48 ` [PATCH 32/32] random: " Christoph Hellwig
  -- strict thread matches above, loose matches on Subject: below --
2018-05-11 11:07 aio poll and a new in-kernel poll API V10 Christoph Hellwig
2018-05-11 11:07 ` [PATCH 10/32] aio: implement IOCB_CMD_POLL Christoph Hellwig
2018-03-30 15:07 aio poll and a new in-kernel poll API V9 Christoph Hellwig
2018-03-30 15:07 ` [PATCH 10/32] aio: implement IOCB_CMD_POLL Christoph Hellwig

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180520053219.GZ30522@ZenIV.linux.org.uk \
    --to=viro@zeniv.linux.org.uk \
    --cc=avi@scylladb.com \
    --cc=hch@lst.de \
    --cc=linux-aio@kvack.org \
    --cc=linux-api@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --subject='Re: [PATCH 10/32] aio: implement IOCB_CMD_POLL' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).