Skip to content

Commit

Permalink
aio_run_iocb(): kill dead check
Browse files Browse the repository at this point in the history
We check if ->ki_pos is positive.  However, by that point we have
already done rw_verify_area(), which would have rejected such
unless the file had been one of /dev/mem, /dev/kmem and /proc/kcore.
All of which do not have vectored rw methods, so we would've bailed
out even earlier.

This check had been introduced before rw_verify_area() had been added there
- in fact, it was a subset of checks done on sync paths by rw_verify_area()
(back then the /dev/mem exception didn't exist at all).  The rest of checks
(mandatory locking, etc.) hadn't been added until later.  Unfortunately,
by the time the call of rw_verify_area() got added, the /dev/mem exception
had already appeared, so it wasn't obvious that the older explicit check
downstream had become dead code.  It *is* a dead code, though, since the few
files for which the exception applies do not have ->aio_{read,write}() or
->{read,write}_iter() and for them we won't reach that check anyway.

What's more, even if we ever introduce vectored methods for /dev/mem
and friends, they'll have to cope with negative positions anyway, since
readv(2) and writev(2) are using the same checks as read(2) and write(2) -
i.e. rw_verify_area().

Let's bury it.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  • Loading branch information
Al Viro committed Apr 12, 2015
1 parent 08397ac commit 47e3936
Showing 1 changed file with 0 additions and 7 deletions.
7 changes: 0 additions & 7 deletions fs/aio.c
Original file line number Diff line number Diff line change
Expand Up @@ -1422,13 +1422,6 @@ static ssize_t aio_run_iocb(struct kiocb *req, unsigned opcode,

len = ret;

/* XXX: move/kill - rw_verify_area()? */
/* This matches the pread()/pwrite() logic */
if (req->ki_pos < 0) {
ret = -EINVAL;
break;
}

if (rw == WRITE)
file_start_write(file);

Expand Down

0 comments on commit 47e3936

Please sign in to comment.