Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-17 02:15:57 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fs/aio: Make io_cancel() generate completions again

Browse Source 
The following patch accidentally removed the code for delivering
completions for cancelled reads and writes to user space: "[PATCH 04/33]
aio: remove retry-based AIO"
(https://lore.kernel.org/all/1363883754-27966-5-git-send-email-koverstreet@google.com/)
>From that patch:

-	if (kiocbIsCancelled(iocb)) {
-		ret = -EINTR;
-		aio_complete(iocb, ret, 0);
-		/* must not access the iocb after this */
-		goto out;
-	}

This leads to a leak in user space of a struct iocb. Hence this patch
that restores the code that reports to user space that a read or write
has been cancelled successfully.

Fixes: 41003a7bcfed ("aio: remove retry-based AIO")
Cc: Christoph Hellwig <hch@lst.de>
Cc: Avi Kivity <avi@scylladb.com>
Cc: Sandeep Dhavale <dhavale@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: stable@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20240215204739.2677806-3-bvanassche@acm.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Bart Van Assche 2024-02-15 12:47:39 -08:00 committed by Christian Brauner
parent 5f7a076466
commit 54cbc058d8
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 11 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
fs/aio.c
View File

@ -2165,14 +2165,11 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
#endif #endif
/* sys_io_cancel: /* sys_io_cancel:
* Attempts to cancel an iocb previously passed to io_submit. If * Attempts to cancel an iocb previously passed to io_submit(). If the
* the operation is successfully cancelled, the resulting event is * operation is successfully cancelled 0 is returned. May fail with
* copied into the memory pointed to by result without being placed * -EFAULT if any of the data structures pointed to are invalid. May
* into the completion queue and 0 is returned. May fail with * fail with -EINVAL if aio_context specified by ctx_id is invalid. Will
* -EFAULT if any of the data structures pointed to are invalid. * fail with -ENOSYS if not implemented.
* May fail with -EINVAL if aio_context specified by ctx_id is
* invalid. May fail with -EAGAIN if the iocb specified was not
* cancelled. Will fail with -ENOSYS if not implemented.
*/ */
SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
struct io_event __user *, result) struct io_event __user *, result)
@ -2203,14 +2200,12 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
} }
spin_unlock_irq(&ctx->ctx_lock); spin_unlock_irq(&ctx->ctx_lock);
if (!ret) { /*
/* * The result argument is no longer used - the io_event is always
* The result argument is no longer used - the io_event is * delivered via the ring buffer.
* always delivered via the ring buffer. -EINPROGRESS indicates */
* cancellation is progress: if (ret == 0 && kiocb->rw.ki_flags & IOCB_AIO_RW)
*/ aio_complete_rw(&kiocb->rw, -EINTR);
ret = -EINPROGRESS;
}
percpu_ref_put(&ctx->users); percpu_ref_put(&ctx->users);