Commit e5313c14 authored Sep 20, 2017 by Omar Sandoval Committed by Jens Axboe Sep 25, 2017

loop: remove union of use_aio and ref in struct loop_cmd



When the request is completed, lo_complete_rq() checks cmd->use_aio.
However, if this is in fact an aio request, cmd->use_aio will have
already been reused as cmd->ref by lo_rw_aio*. Fix it by not using a
union. On x86_64, there's a hole after the union anyways, so this
doesn't make struct loop_cmd any bigger.

Fixes: 92d77332 ("block/loop: fix use after free")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent 5acb3cc2

drivers/block/loop.h

+2 −4

Original line number	Diff line number	Diff line
		@@ -67,10 +67,8 @@ struct loop_device {
		struct loop_cmd {
		struct kthread_work work;
		struct request *rq;
		union {
		bool use_aio; /* use AIO interface to handle I/O */
		atomic_t ref; /* only for aio */
		};
		long ret;
		struct kiocb iocb;
		struct bio_vec *bvec;