CVE-2012-0058 Unused iocbs in a batch should not be accounted as active

  (rhbz 782696)

2 files changed, 76 insertions, 0 deletions

diff --git a/Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch b/Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
new file mode 100644
index 000000000..9dd9fc841
--- /dev/null
+++ b/Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
@@ -0,0 +1,68 @@
+From 69e4747ee9727d660b88d7e1efe0f4afcb35db1b Mon Sep 17 00:00:00 2001
+From: Gleb Natapov <gleb@redhat.com>
+Date: Sun, 8 Jan 2012 17:07:28 +0200
+Subject: [PATCH] Unused iocbs in a batch should not be accounted as active.
+
+Since commit 080d676de095 ("aio: allocate kiocbs in batches") iocbs are
+allocated in a batch during processing of first iocbs.  All iocbs in a
+batch are automatically added to ctx->active_reqs list and accounted in
+ctx->reqs_active.
+
+If one (not the last one) of iocbs submitted by an user fails, further
+iocbs are not processed, but they are still present in ctx->active_reqs
+and accounted in ctx->reqs_active.  This causes process to stuck in a D
+state in wait_for_all_aios() on exit since ctx->reqs_active will never
+go down to zero.  Furthermore since kiocb_batch_free() frees iocb
+without removing it from active_reqs list the list become corrupted
+which may cause oops.
+
+Fix this by removing iocb from ctx->active_reqs and updating
+ctx->reqs_active in kiocb_batch_free().
+
+Signed-off-by: Gleb Natapov <gleb@redhat.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Cc: stable@kernel.org   # 3.2
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ fs/aio.c |   11 +++++++++--
+ 1 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/fs/aio.c b/fs/aio.c
+index 78c514c..969beb0 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -476,14 +476,21 @@ static void kiocb_batch_init(struct kiocb_batch *batch, long total)
+ 	batch->count = total;
+ }
+ 
+-static void kiocb_batch_free(struct kiocb_batch *batch)
++static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
+ {
+ 	struct kiocb *req, *n;
+ 
++	if (list_empty(&batch->head))
++		return;
++
++	spin_lock_irq(&ctx->ctx_lock);
+ 	list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
+ 		list_del(&req->ki_batch);
++		list_del(&req->ki_list);
+ 		kmem_cache_free(kiocb_cachep, req);
++		ctx->reqs_active--;
+ 	}
++	spin_unlock_irq(&ctx->ctx_lock);
+ }
+ 
+ /*
+@@ -1742,7 +1749,7 @@ long do_io_submit(aio_context_t ctx_id, long nr,
+ 	}
+ 	blk_finish_plug(&plug);
+ 
+-	kiocb_batch_free(&batch);
++	kiocb_batch_free(ctx, &batch);
+ 	put_ioctx(ctx);
+ 	return i ? i : ret;
+ }
+-- 
+1.7.7.5
+
diff --git a/kernel.spec b/kernel.spec
index 9f7ff0829..73c881a94 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -767,6 +767,9 @@ Patch21076: rtl8192cu-Fix-WARNING-on-suspend-resume.patch
 #rhbz 782681
 Patch21085: proc-clean-up-and-fix-proc-pid-mem-handling.patch
 
+#rhbz 782696
+Patch21086: Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
+
 # compat-wireless patches
 Patch50000: compat-wireless-config-fixups.patch
 Patch50001: compat-wireless-pr_fmt-warning-avoidance.patch
@@ -1490,6 +1493,9 @@ ApplyPatch rtl8192cu-Fix-WARNING-on-suspend-resume.patch
 #rhbz 782681
 ApplyPatch proc-clean-up-and-fix-proc-pid-mem-handling.patch
 
+#rhbz 782696
+ApplyPatch Unused-iocbs-in-a-batch-should-not-be-accounted-as-a.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2330,6 +2336,8 @@ fi
 %changelog
 * Wed Jan 18 2012 Josh Boyer <jwboyer@redhat.com>
 - CVE-2012-0056 proc: clean up and fix /proc/<pid>/mem (rhbz 782681)
+- CVE-2012-0058 Unused iocbs in a batch should not be accounted as active
+  (rhbz 782696)
 
 * Tue Jan 17 2012 Dave Jones <davej@redhat.com>
 - Rawhide builds now use MAXSMP on x86.