Re: [PATCH] Oops in aio_free_ring on 2.6.9

[Linus Torvalds]

On Fri, 5 Nov 2004, Darrick J. Wong wrote:
> 
> Next, the aio_setup_ring function tries to mmap a bunch of pages and
> fails, because in step 1 we used up all the address space. 
> aio_setup_ring then calls aio_free_ring to tear all of this down.
> (fs/aio.c:143)
> 
> aio_free_ring sees the block of struct page pointers and calls free_page
> (fs/aio.c:88) on the pointers without checking that they're not NULL. 
> Unfortunately, they _are_ NULL and *oops*!  My patch amends the function
> to include a null pointer check.

I don't disagree with the bug, but I disagree with the fix. 

In my opinion, the problem is that "info->nr_pages" is _wrong_. It's wrong 
because it has been initialized to a bogus value. 

I'd much prefer this alternate appended patch. Can you verify that it also 
fixes the problem (we can drop the bogus info->nr_pages initialization, 
because the context - including the info part - has been cleared when it 
was allocated, so nr_pages should already have the _correct_ value of zero 
at this point).

		Linus

-----
===== fs/aio.c 1.60 vs edited =====
--- 1.60/fs/aio.c	2004-10-20 01:12:10 -07:00
+++ edited/fs/aio.c	2004-11-06 19:41:45 -08:00
@@ -118,8 +118,6 @@
 	if (nr_pages < 0)
 		return -EINVAL;
 
-	info->nr_pages = nr_pages;
-
 	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
 
 	info->nr = 0;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/