aio: fix kernel memory disclosure in io_getevents() introduced in v3.10

[linux-beck.git] / fs / aio.c

diff --git a/fs/aio.c b/fs/aio.c
index 6a9c7e489adff02661e1c9b016423248fb6b9076..955947ef3e0263590b64162f5888b81822196415 100644 (file)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1063,6 +1063,9 @@ static long aio_read_events_ring(struct kioctx *ctx,
        if (head == tail)
                goto out;
 
+       head %= ctx->nr_events;
+       tail %= ctx->nr_events;
+
        while (ret < nr) {
                long avail;
                struct io_event *ev;