• Mikulas Patocka's avatar
    dm io: make sync_io uninterruptible · b64b6bf4
    Mikulas Patocka authored
    If someone sends signal to a process performing synchronous dm-io call,
    the kernel may crash.
    
    The function sync_io attempts to exit with -EINTR if it has pending signal,
    however the structure "io" is allocated on stack, so already submitted io
    requests end up touching unallocated stack space and corrupting kernel memory.
    
    sync_io sets its state to TASK_UNINTERRUPTIBLE, so the signal can't break out
    of io_schedule() --- however, if the signal was pending before sync_io entered
    while (1) loop, the corruption of kernel memory will happen.
    
    There is no way to cancel in-progress IOs, so the best solution is to ignore
    signals at this point.
    
    Cc: stable@kernel.org
    Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
    b64b6bf4
dm-io.c 10.8 KB