Messages in this thread | | | Date | Mon, 17 Oct 2016 21:54:54 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes) |
| |
On Mon, Oct 17, 2016 at 03:40:24PM -0400, Jeff Moyer wrote: > Christoph Hellwig <hch@lst.de> writes: > > > On Mon, Oct 17, 2016 at 02:19:47PM -0400, Jeff Moyer wrote: > >> This ends up being a call to __sb_end_write: > >> > >> void __sb_end_write(struct super_block *sb, int level) > >> { > >> percpu_up_read(sb->s_writers.rw_sem + level-1); > >> } > >> > >> Nothing guarantees that submission and completion happen on the same > >> CPU. Is this safe? > > > > Good point. From my reading of the percpu_rwsem implementation it > > is not safe to release it from a different CPU. Which makes me > > wonder how we can protect aio writes properly here.. > > Could we just change percpu_rw_semaphore->read_count to be a signed > integer? The down_write path sums up the counters from all cpus...
To what point?
| |