summaryrefslogtreecommitdiff
path: root/fs/open.c
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2018-05-24 05:53:22 +0300
committerAl Viro <viro@zeniv.linux.org.uk>2018-05-24 05:53:22 +0300
commit4faa99965e027cc057c5145ce45fa772caa04e8d (patch)
tree5c0c1e8d18e1a4f0964fe8b40e343ecd9cfbada8 /fs/open.c
parentbaf10564fbb66ea222cae66fbff11c444590ffd9 (diff)
downloadlinux-4faa99965e027cc057c5145ce45fa772caa04e8d.tar.xz
fix io_destroy()/aio_complete() race
If io_destroy() gets to cancelling everything that can be cancelled and gets to kiocb_cancel() calling the function driver has left in ->ki_cancel, it becomes vulnerable to a race with IO completion. At that point req is already taken off the list and aio_complete() does *NOT* spin until we (in free_ioctx_users()) releases ->ctx_lock. As the result, it proceeds to kiocb_free(), freing req just it gets passed to ->ki_cancel(). Fix is simple - remove from the list after the call of kiocb_cancel(). All instances of ->ki_cancel() already have to cope with the being called with iocb still on list - that's what happens in io_cancel(2). Cc: stable@kernel.org Fixes: 0460fef2a921 "aio: use cancellation list lazily" Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/open.c')
0 files changed, 0 insertions, 0 deletions