summaryrefslogtreecommitdiff
path: root/drivers/block/loop.h
diff options
context:
space:
mode:
authorOmar Sandoval <osandov@fb.com>2017-09-21 00:24:34 +0300
committerJens Axboe <axboe@kernel.dk>2017-09-25 17:56:05 +0300
commite5313c141b49c1b1af43d1ca81398185d66ad1a6 (patch)
tree0e2440f48680900a99bcd9e3e9b3333f11b1a000 /drivers/block/loop.h
parent5acb3cc2c2e9d3020a4fee43763c6463767f1572 (diff)
downloadlinux-e5313c141b49c1b1af43d1ca81398185d66ad1a6.tar.xz
loop: remove union of use_aio and ref in struct loop_cmd
When the request is completed, lo_complete_rq() checks cmd->use_aio. However, if this is in fact an aio request, cmd->use_aio will have already been reused as cmd->ref by lo_rw_aio*. Fix it by not using a union. On x86_64, there's a hole after the union anyways, so this doesn't make struct loop_cmd any bigger. Fixes: 92d773324b7e ("block/loop: fix use after free") Signed-off-by: Omar Sandoval <osandov@fb.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers/block/loop.h')
-rw-r--r--drivers/block/loop.h6
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index f68c1d50802f..1f3956702993 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -67,10 +67,8 @@ struct loop_device {
struct loop_cmd {
struct kthread_work work;
struct request *rq;
- union {
- bool use_aio; /* use AIO interface to handle I/O */
- atomic_t ref; /* only for aio */
- };
+ bool use_aio; /* use AIO interface to handle I/O */
+ atomic_t ref; /* only for aio */
long ret;
struct kiocb iocb;
struct bio_vec *bvec;