aio: fix aio request leak when events are reaped by userspace
authorBenjamin LaHaise <bcrl@kvack.org>
Tue, 24 Jun 2014 17:12:55 +0000 (13:12 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 1 Jul 2014 03:12:01 +0000 (20:12 -0700)
commitb0c60b4efb13a8b1b37288c9acada13019739d92
tree282b1eca0f40b3f333b3529380f2c2013472fd72
parentcc40a2916d3f2c7495410385bae08cfd58192071
aio: fix aio request leak when events are reaped by userspace

commit f8567a3845ac05bb28f3c1b478ef752762bd39ef upstream.

The aio cleanups and optimizations by kmo that were merged into the 3.10
tree added a regression for userspace event reaping.  Specifically, the
reference counts are not decremented if the event is reaped in userspace,
leading to the application being unable to submit further aio requests.
This patch applies to 3.12+.  A separate backport is required for 3.10/3.11.
This issue was uncovered as part of CVE-2014-0206.

Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
Cc: Kent Overstreet <kmo@daterainc.com>
Cc: Mateusz Guzik <mguzik@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/aio.c