Vulnerability: The kiocb_batch_free function in fs/aio.c in the Linux kernel before 3.2.2 allows local users to cause a denial of service (OOPS) via vectors that trigger incorrect iocb management.
Vulnerability ID: CVE-2012-0058
CWE: CWE-400
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-17
File: fs/aio.c
Commit message: Unused iocbs in a batch should not be accounted as active.

commit 69e4747ee9727d660b88d7e1efe0f4afcb35db1b upstream.

Since commit 080d676de095 ("aio: allocate kiocbs in batches") iocbs are
allocated in a batch during processing of first iocbs.  All iocbs in a
batch are automatically added to ctx->active_reqs list and accounted in
ctx->reqs_active.

If one (not the last one) of iocbs submitted by an user fails, further
iocbs are not processed, but they are still present in ctx->active_reqs
and accounted in ctx->reqs_active.  This causes process to stuck in a D
state in wait_for_all_aios() on exit since ctx->reqs_active will never
go down to zero.  Furthermore since kiocb_batch_free() frees iocb
without removing it from active_reqs list the list become corrupted
which may cause oops.

Fix this by removing iocb from ctx->active_reqs and updating
ctx->reqs_active in kiocb_batch_free().

Signed-off-by: Gleb Natapov <gleb@redhat.com>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit author: Gleb Natapov

Vulnerable version (before fix):
 static void kiocb_batch_init(struct kiocb_batch *batch, long total) 	batch->count = total; }  static void kiocb_batch_free(struct kiocb_batch *batch) { 	struct kiocb *req, *n;  	list_for_each_entry_safe(req, n, &batch->head, ki_batch) { 		list_del(&req->ki_batch); 		kmem_cache_free(kiocb_cachep, req); 	} }  /* long do_io_submit(aio_context_t ctx_id, long nr, 	} 	blk_finish_plug(&plug);  	kiocb_batch_free(&batch); 	put_ioctx(ctx); 	return i ? i : ret; }

Fixed version (after fix):
 static void kiocb_batch_init(struct kiocb_batch *batch, long total) 	batch->count = total; }  static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch) { 	struct kiocb *req, *n;  	if (list_empty(&batch->head)) 		return;  	spin_lock_irq(&ctx->ctx_lock); 	list_for_each_entry_safe(req, n, &batch->head, ki_batch) { 		list_del(&req->ki_batch); 		list_del(&req->ki_list); 		kmem_cache_free(kiocb_cachep, req); 		ctx->reqs_active--; 	} 	spin_unlock_irq(&ctx->ctx_lock); }  /* long do_io_submit(aio_context_t ctx_id, long nr, 	} 	blk_finish_plug(&plug);  	kiocb_batch_free(ctx, &batch); 	put_ioctx(ctx); 	return i ? i : ret; }

Patch:
patch: @@ -476,14 +476,21 @@ static void kiocb_batch_init(struct kiocb_batch *batch, long total)
 	batch->count = total;
 }
 
-static void kiocb_batch_free(struct kiocb_batch *batch)
+static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
 {
 	struct kiocb *req, *n;
 
+	if (list_empty(&batch->head))
+		return;
+
+	spin_lock_irq(&ctx->ctx_lock);
 	list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
 		list_del(&req->ki_batch);
+		list_del(&req->ki_list);
 		kmem_cache_free(kiocb_cachep, req);
+		ctx->reqs_active--;
 	}
+	spin_unlock_irq(&ctx->ctx_lock);
 }
 
 /*
@@ -1742,7 +1749,7 @@ long do_io_submit(aio_context_t ctx_id, long nr,
 	}
 	blk_finish_plug(&plug);
 
-	kiocb_batch_free(&batch);
+	kiocb_batch_free(ctx, &batch);
 	put_ioctx(ctx);
 	return i ? i : ret;
 }
path: fs/aio.c