uml: fix request->sector update (0a6d3a2a) · Commits · 戴 / test

It is theoretically possible for a request to finish and be freed between writing it to the I/O thread and updating the sector count. In this case, the update will dereference a freed pointer. To avoid this, I delay the update until processing the next sg segment, when the request pointer is known to be good. Signed-off-by:

Jeff Dike <jdike@linux.intel.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

arch/um/drivers/ubd_kern.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -1083,7 +1083,7 @@ static void do_ubd_request(request_queue_t *q)
		{
		struct io_thread_req *io_req;
		struct request *req;
		int n;
		int n, last_sectors;

		while(1){
		struct ubd *dev = q->queuedata;
		@@ -1099,9 +1099,11 @@ static void do_ubd_request(request_queue_t *q)
		}

		req = dev->request;
		last_sectors = 0;
		while(dev->start_sg < dev->end_sg){
		struct scatterlist *sg = &dev->sg[dev->start_sg];

		req->sector += last_sectors;
		io_req = kmalloc(sizeof(struct io_thread_req),
		GFP_ATOMIC);
		if(io_req == NULL){
		@@ -1113,6 +1115,7 @@ static void do_ubd_request(request_queue_t *q)
		(unsigned long long) req->sector << 9,
		sg->offset, sg->length, sg->page);

		last_sectors = sg->length >> 9;
		n = os_write_file(thread_fd, &io_req,
		sizeof(struct io_thread_req *));
		if(n != sizeof(struct io_thread_req *)){
		@@ -1124,7 +1127,6 @@ static void do_ubd_request(request_queue_t *q)
		return;
		}

		req->sector += sg->length >> 9;
		dev->start_sg++;
		}
		dev->end_sg = 0;

Admin message