Messages in this thread | | | From | Jeff Moyer <> | Subject | Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes) | Date | Mon, 17 Oct 2016 14:19:47 -0400 |
| |
Hi, Christoph,
Christoph Hellwig <hch@lst.de> writes:
> diff --git a/fs/aio.c b/fs/aio.c > index 1157e13..bf315cd 100644 > --- a/fs/aio.c > +++ b/fs/aio.c > @@ -1078,6 +1078,17 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2) > unsigned tail, pos, head; > unsigned long flags; > > + if (kiocb->ki_flags & IOCB_WRITE) { > + struct file *file = kiocb->ki_filp; > + > + /* > + * Tell lockdep we inherited freeze protection from submission > + * thread. > + */ > + __sb_writers_acquired(file_inode(file)->i_sb, SB_FREEZE_WRITE); > + file_end_write(file);
This ends up being a call to __sb_end_write:
void __sb_end_write(struct super_block *sb, int level) { percpu_up_read(sb->s_writers.rw_sem + level-1); }
Nothing guarantees that submission and completion happen on the same CPU. Is this safe?
-Jeff
| |