KASAN: use-after-free Read in unix_dgram_poll · syzbot <hidden> · 2019-03-03
Re: KASAN: use-after-free Read in unix_dgram_poll · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-03
[PATCH] aio: prevent the final fput() in the middle of vfs_poll() (Re: KASAN: use-after-free Read in unix_dgram_poll) · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-03
Re: [PATCH] aio: prevent the final fput() in the middle of vfs_poll() (Re: KASAN: use-after-free Read in unix_dgram_poll) · Eric Dumazet <hidden> · 2019-03-03
Re: [PATCH] aio: prevent the final fput() in the middle of vfs_poll() (Re: KASAN: use-after-free Read in unix_dgram_poll) · Linus Torvalds <torvalds@linux-foundation.org> · 2019-03-03
Re: [PATCH] aio: prevent the final fput() in the middle of vfs_poll() (Re: KASAN: use-after-free Read in unix_dgram_poll) · Linus Torvalds <torvalds@linux-foundation.org> · 2019-03-03
Re: [PATCH] aio: prevent the final fput() in the middle of vfs_poll() (Re: KASAN: use-after-free Read in unix_dgram_poll) · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-03
Re: [PATCH] aio: prevent the final fput() in the middle of vfs_poll() (Re: KASAN: use-after-free Read in unix_dgram_poll) · Linus Torvalds <torvalds@linux-foundation.org> · 2019-03-03
Re: [PATCH] aio: prevent the final fput() in the middle of vfs_poll() (Re: KASAN: use-after-free Read in unix_dgram_poll) · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-04
Re: [PATCH] aio: prevent the final fput() in the middle of vfs_poll() (Re: KASAN: use-after-free Read in unix_dgram_poll) · Linus Torvalds <torvalds@linux-foundation.org> · 2019-03-04
[PATCH 1/8] aio: make sure file is pinned · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-07
[PATCH 7/8] deal with get_reqs_available() in aio_get_req() itself · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-07
[PATCH 6/8] move dropping ->ki_eventfd into iocb_put() · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-07
[PATCH 4/8] aio_poll(): get rid of weird refcounting · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-07
[PATCH 5/8] make aio_read()/aio_write() return int · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-07
[PATCH 8/8] aio: move sanity checks and request allocation to io_submit_one() · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-07
[PATCH 3/8] aio_poll(): sanitize the logics after vfs_poll(), get rid of leak on error · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-07
Re: [PATCH 3/8] aio_poll(): sanitize the logics after vfs_poll(), get rid of leak on error · zhengbin (A) <hidden> · 2019-03-07
[PATCH 2/8] aio_poll_wake(): don't set ->woken if we ignore the wakeup · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-07
Re: [PATCH 2/8] aio_poll_wake(): don't set ->woken if we ignore the wakeup · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-07
Re: [PATCH 2/8] aio_poll_wake(): don't set ->woken if we ignore the wakeup · zhengbin (A) <hidden> · 2019-03-08
Re: [PATCH 1/8] aio: make sure file is pinned · Linus Torvalds <torvalds@linux-foundation.org> · 2019-03-07
Re: [PATCH 1/8] aio: make sure file is pinned · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-07
Re: [PATCH 1/8] aio: make sure file is pinned · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-07
Re: [PATCH 1/8] aio: make sure file is pinned · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-07
Re: [PATCH 1/8] aio: make sure file is pinned · Linus Torvalds <torvalds@linux-foundation.org> · 2019-03-07
Re: [PATCH 1/8] aio: make sure file is pinned · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-08
Re: [PATCH 1/8] aio: make sure file is pinned · Christoph Hellwig <hch@lst.de> · 2019-03-08
Re: [PATCH 1/8] aio: make sure file is pinned · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-10
[PATCH 1/8] pin iocb through aio. · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-10
[PATCH 2/8] keep io_event in aio_kiocb · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-10
Re: [PATCH 2/8] keep io_event in aio_kiocb · Christoph Hellwig <hch@lst.de> · 2019-03-11
Re: [PATCH 2/8] keep io_event in aio_kiocb · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-11
[PATCH 3/8] aio: store event at final iocb_put() · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-10
Re: [PATCH 3/8] aio: store event at final iocb_put() · Christoph Hellwig <hch@lst.de> · 2019-03-11
Re: [PATCH 3/8] aio: store event at final iocb_put() · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-11
Re: [PATCH 3/8] aio: store event at final iocb_put() · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-11
[PATCH 4/8] Fix aio_poll() races · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-10
Re: [PATCH 4/8] Fix aio_poll() races · Christoph Hellwig <hch@lst.de> · 2019-03-11
Re: [PATCH 4/8] Fix aio_poll() races · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-11
Re: [PATCH 4/8] Fix aio_poll() races · Christoph Hellwig <hch@lst.de> · 2019-03-12
[PATCH 5/8] make aio_read()/aio_write() return int · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-10
Re: [PATCH 5/8] make aio_read()/aio_write() return int · Christoph Hellwig <hch@lst.de> · 2019-03-11
[PATCH 6/8] move dropping ->ki_eventfd into iocb_destroy() · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-10
Re: [PATCH 6/8] move dropping ->ki_eventfd into iocb_destroy() · Christoph Hellwig <hch@lst.de> · 2019-03-11
[PATCH 7/8] deal with get_reqs_available() in aio_get_req() itself · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-10
Re: [PATCH 7/8] deal with get_reqs_available() in aio_get_req() itself · Christoph Hellwig <hch@lst.de> · 2019-03-11
[PATCH 8/8] aio: move sanity checks and request allocation to io_submit_one() · Al Viro <viro@ZenIV.linux.org.uk> · 2019-03-10
Re: [PATCH 8/8] aio: move sanity checks and request allocation to io_submit_one() · Christoph Hellwig <hch@lst.de> · 2019-03-11
Re: [PATCH 8/8] aio: move sanity checks and request allocation to io_submit_one() · Al Viro <viro@zeniv.linux.org.uk> · 2019-03-11
Re: [PATCH 1/8] pin iocb through aio. · Christoph Hellwig <hch@lst.de> · 2019-03-11
Re: [PATCH 1/8] aio: make sure file is pinned · Christoph Hellwig <hch@lst.de> · 2019-03-11
Re: [PATCH] aio: prevent the final fput() in the middle of vfs_poll() (Re: KASAN: use-after-free Read in unix_dgram_poll) · Dmitry Vyukov <dvyukov@google.com> · 2019-03-04

Re: [PATCH 1/8] aio: make sure file is pinned

From: Christoph Hellwig <hch@lst.de>
Date: 2019-03-08 15:51:10
Also in: linux-fsdevel, lkml

On Fri, Mar 08, 2019 at 03:36:50AM +0000, Al Viro wrote:

See vfs.git#work.aio; the crucial bits are in these commits:
      keep io_event in aio_kiocb
      get rid of aio_complete() res/res2 arguments
      move aio_complete() to final iocb_put(), try to fix aio_poll() logics
The first two are preparations, the last is where the fixes (hopefully)
happen.

Looks sensible.  I'll try to run the tests over it, and I've added
Avi so that maybe he can make sure that scylladb is also happy with it,
that was usually the best way to find aio poll bugs..

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help