loop: remove union of use_aio and ref in struct loop_cmd

When the request is completed, lo_complete_rq() checks cmd->use_aio.
However, if this is in fact an aio request, cmd->use_aio will have
already been reused as cmd->ref by lo_rw_aio*. Fix it by not using a
union. On x86_64, there's a hole after the union anyways, so this
doesn't make struct loop_cmd any bigger.

Fixes: 92d773324b7e ("block/loop: fix use after free")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index f68c1d50802fddb3289480124fc1459c9b66ea9e..1f3956702993883859070b2ef39a9b164978a213 100644 (file)
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -67,10 +67,8 @@ struct loop_device {
 struct loop_cmd {
        struct kthread_work work;
        struct request *rq;
-       union {
-               bool use_aio; /* use AIO interface to handle I/O */
-               atomic_t ref; /* only for aio */
-       };
+       bool use_aio; /* use AIO interface to handle I/O */
+       atomic_t ref; /* only for aio */
        long ret;
        struct kiocb iocb;
        struct bio_vec *bvec;