diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2021-07-16 02:38:46 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-07-30 00:32:58 +0000 |
| commit | 9ac0aec3a32c84599cfbcc9f70ca2e035a3ddc0b (patch) | |
| tree | eda7cc6dcd5423800854c823e2cf98b5a5d8d925 /sys/kern/vfs_aio.c | |
| parent | 24c558ca3c04e23681ddefe13d0cd5f98bba9fac (diff) | |
| download | src-9ac0aec3a32c84599cfbcc9f70ca2e035a3ddc0b.tar.gz src-9ac0aec3a32c84599cfbcc9f70ca2e035a3ddc0b.zip | |
lio_listio: Don't post a completion notification if none was requested
One is allowed to use LIO_NOWAIT without specifying a sigevent. In this
case, lj->lioj_signal is left uninitialized, but several code paths
examine liov_signal.sigev_notify to figure out which notification to
post. Unconditionally initialize that field to SIGEV_NONE.
Add a dumb test case which triggers the bug.
Reported by: KMSAN+syzkaller
Reviewed by: asomers
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 2e5f6152952e4cfbaab3d96368c3dc4218786632)
Diffstat (limited to 'sys/kern/vfs_aio.c')
| -rw-r--r-- | sys/kern/vfs_aio.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/kern/vfs_aio.c b/sys/kern/vfs_aio.c index 640e82b6f0ff..7d4d9ac3e94b 100644 --- a/sys/kern/vfs_aio.c +++ b/sys/kern/vfs_aio.c @@ -2246,6 +2246,7 @@ kern_lio_listio(struct thread *td, int mode, struct aiocb * const *uacb_list, lj->lioj_flags = 0; lj->lioj_count = 0; lj->lioj_finished_count = 0; + lj->lioj_signal.sigev_notify = SIGEV_NONE; knlist_init_mtx(&lj->klist, AIO_MTX(ki)); ksiginfo_init(&lj->lioj_ksi); |