| From: Seth Jenkins <sethjenkins@google.com> |
| Subject: aio: fix mremap after fork null-deref |
| Date: Tue, 31 Jan 2023 12:25:55 -0500 |
| |
| Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced |
| a null-deref if mremap is called on an old aio mapping after fork as |
| mm->ioctx_table will be set to NULL. |
| |
| [jmoyer@redhat.com: fix 80 column issue] |
| Link: https://lkml.kernel.org/r/x49sffq4nvg.fsf@segfault.boston.devel.redhat.com |
| Fixes: e4a0d3e720e7 ("aio: Make it possible to remap aio ring") |
| Signed-off-by: Seth Jenkins <sethjenkins@google.com> |
| Signed-off-by: Jeff Moyer <jmoyer@redhat.com> |
| Cc: Alexander Viro <viro@zeniv.linux.org.uk> |
| Cc: Benjamin LaHaise <bcrl@kvack.org> |
| Cc: Jann Horn <jannh@google.com> |
| Cc: Pavel Emelyanov <xemul@parallels.com> |
| Cc: <stable@vger.kernel.org> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| --- |
| |
| |
| --- a/fs/aio.c~aio-fix-mremap-after-fork-null-deref |
| +++ a/fs/aio.c |
| @@ -361,6 +361,9 @@ static int aio_ring_mremap(struct vm_are |
| spin_lock(&mm->ioctx_lock); |
| rcu_read_lock(); |
| table = rcu_dereference(mm->ioctx_table); |
| + if (!table) |
| + goto out_unlock; |
| + |
| for (i = 0; i < table->nr; i++) { |
| struct kioctx *ctx; |
| |
| @@ -374,6 +377,7 @@ static int aio_ring_mremap(struct vm_are |
| } |
| } |
| |
| +out_unlock: |
| rcu_read_unlock(); |
| spin_unlock(&mm->ioctx_lock); |
| return res; |
| _ |
