diff mbox

loop: remove union of use_aio and ref in struct loop_cmd

Message ID f1805518db399aa091aaada51de4d9153963d77f.1505942666.git.osandov@fb.com (mailing list archive)
State New, archived
Headers show

Commit Message

Omar Sandoval Sept. 20, 2017, 9:24 p.m. UTC 
From: Omar Sandoval <osandov@fb.com>

When the request is completed, lo_complete_rq() checks cmd->use_aio.
However, if this is in fact an aio request, cmd->use_aio will have
already been reused as cmd->ref by lo_rw_aio*. Fix it by not using a
union. On x86_64, there's a hole after the union anyways, so this
doesn't make struct loop_cmd any bigger.

Fixes: 92d773324b7e ("block/loop: fix use after free")
Signed-off-by: Omar Sandoval <osandov@fb.com>
---
 drivers/block/loop.h | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

Comments

Jens Axboe Sept. 20, 2017, 9:27 p.m. UTC | #1 
On 09/20/2017 03:24 PM, Omar Sandoval wrote:
> From: Omar Sandoval <osandov@fb.com>
> 
> When the request is completed, lo_complete_rq() checks cmd->use_aio.
> However, if this is in fact an aio request, cmd->use_aio will have
> already been reused as cmd->ref by lo_rw_aio*. Fix it by not using a
> union. On x86_64, there's a hole after the union anyways, so this
> doesn't make struct loop_cmd any bigger.

Thanks Omar, applied.
diff mbox

Patch

diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index f68c1d50802f..1f3956702993 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -67,10 +67,8 @@  struct loop_device {
 struct loop_cmd {
 	struct kthread_work work;
 	struct request *rq;
-	union {
-		bool use_aio; /* use AIO interface to handle I/O */
-		atomic_t ref; /* only for aio */
-	};
+	bool use_aio; /* use AIO interface to handle I/O */
+	atomic_t ref; /* only for aio */
 	long ret;
 	struct kiocb iocb;
 	struct bio_vec *bvec;