Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux/fs
History
Al Viro c7b2855505 aio: fix the "too late munmap()" race 
Current code has put_ioctx() called asynchronously from aio_fput_routine();
that's done *after* we have killed the request that used to pin ioctx,
so there's nothing to stop io_destroy() waiting in wait_for_all_aios()
from progressing.  As the result, we can end up with async call of
put_ioctx() being the last one and possibly happening during exit_mmap()
or elf_core_dump(), neither of which expects stray munmap() being done
to them...

We do need to prevent _freeing_ ioctx until aio_fput_routine() is done
with that, but that's all we care about - neither io_destroy() nor
exit_aio() will progress past wait_for_all_aios() until aio_fput_routine()
does really_put_req(), so the ioctx teardown won't be done until then
and we don't care about the contents of ioctx past that point.

Since actual freeing of these suckers is RCU-delayed, we don't need to
bump ioctx refcount when request goes into list for async removal.
All we need is rcu_read_lock held just over the ->ctx_lock-protected
area in aio_fput_routine().

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Acked-by: Benjamin LaHaise <bcrl@kvack.org>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 		2012-03-09 18:59:59 -08:00
..
9p Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs 2012-01-10 15:09:01 -08:00
adfs
…
affs
…
afs
…
autofs4 autofs: work around unhappy compat problem on x86-64 2012-02-25 12:10:27 -08:00
befs
…
bfs
…
btrfs Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs 2012-03-09 18:09:18 -08:00
cachefiles
…
ceph Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client 2012-02-02 15:47:33 -08:00
cifs cifs: fix dentry refcount leak when opening a FIFO on lookup 2012-02-26 23:16:26 -06:00
coda coda: switch coda_cnode_make() to sane API as well, clean coda_lookup() 2012-01-10 11:13:16 -05:00
configfs
…
cramfs
…
debugfs kernel-doc: fix new warnings in debugfs 2012-01-24 10:47:41 -08:00
devpts devpts: fix double-free on mount failure 2012-01-08 20:19:03 -05:00
dlm Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm 2012-01-10 14:55:55 -08:00
ecryptfs ecryptfs: fix printk format warning for size_t 2012-02-28 16:55:30 -08:00
efs
…
exofs Merge branch 'for-linus' of git://git.open-osd.org/linux-open-osd 2012-01-09 12:51:01 -08:00
exportfs
…
ext2 ext2: protect inode changes in the SETVERSION and SETFLAGS ioctls 2012-01-11 13:39:02 +01:00
ext3 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 2012-01-09 12:51:21 -08:00
ext4 Merge branch 'for_linus' into for_linus_merged 2012-01-10 11:54:07 -05:00
fat Merge branch 'usb-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 2012-01-09 12:09:47 -08:00
freevxfs
…
fscache
…
fuse Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse 2012-01-12 12:39:21 -08:00
gfs2 GFS2: Read resource groups on mount 2012-02-28 09:52:39 +00:00
hfs
…
hfsplus hfsplus: creation of hidden dir on mount can fail 2012-01-10 17:48:52 -05:00
hostfs
…
hpfs
…
hppfs
…
hugetlbfs mm: compaction: introduce sync-light migration for use by compaction 2012-01-12 20:13:09 -08:00
isofs isofs: inode leak on mount failure 2012-01-09 10:48:11 -05:00
jbd jbd: Issue cache flush after checkpointing 2012-01-11 13:36:57 +01:00
jbd2 Merge branch 'for_linus' into for_linus_merged 2012-01-10 11:54:07 -05:00
jffs2 jffs2: do not initialize variable unnecessarily 2012-01-11 09:53:51 +00:00
jfs Merge branch 'pm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 2012-01-08 13:10:57 -08:00
lockd module_param: make bool parameters really bool (drivers & misc) 2012-01-13 09:32:20 +10:30
logfs mtd: fix merge conflict resolution breakage 2012-02-01 11:10:24 -08:00
minix Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-01-08 12:19:57 -08:00
ncpfs
…
nfs NFSv4: fix server_scope memory leak 2012-02-17 17:34:03 -05:00
nfs_common
…
nfsd Merge branch 'for-3.3' of git://linux-nfs.org/~bfields/linux 2012-01-14 12:26:41 -08:00
nilfs2 nilfs2: avoid overflowing segment numbers in nilfs_ioctl_clean_segments() 2012-02-08 19:03:51 -08:00
nls
…
notify fsnotify: don't BUG in fsnotify_destroy_mark() 2012-01-14 18:01:42 -08:00
ntfs NTFS: Correct two spelling errors "dealocate" to "deallocate" in mft.c. 2012-02-24 09:17:09 +00:00
ocfs2 ocfs2: deal with wraparounds of i_nlink in ocfs2_rename() 2012-02-13 20:45:39 -05:00
omfs
…
openpromfs
…
proc Fix race in process_vm_rw_core 2012-02-02 12:55:17 -08:00
pstore
…
qnx4 qnx4: don't leak ->BitMap on late failure exits 2012-01-19 13:54:36 -05:00
quota quota: Fix deadlock with suspend and quotas 2012-02-13 20:45:39 -05:00
ramfs
…
reiserfs reiserfs: don't lock root inode searching 2012-01-10 16:30:54 -08:00
romfs MTD pull for 3.3 2012-01-10 13:45:22 -08:00
squashfs Merge git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-next 2012-01-13 10:34:57 -08:00
sysfs sysfs: Complain bitterly about attempts to remove files from nonexistent directories. 2012-01-24 12:12:32 -08:00
sysv
…
ubifs UBIFS: fix non-debug configuration build 2012-01-15 13:46:02 +02:00
udf Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 2012-01-09 12:51:21 -08:00
ufs
…
xfs xfs: make inode quota check more general 2012-02-21 10:12:43 -06:00
Kconfig Merge branch 'for-linus' of git://git.open-osd.org/linux-open-osd 2012-01-09 12:51:01 -08:00
Kconfig.binfmt fs: binfmt_elf: create Kconfig variable for PIE randomization 2012-01-10 16:30:51 -08:00
Makefile
…
aio.c aio: fix the "too late munmap()" race 2012-03-09 18:59:59 -08:00
anon_inodes.c
…
attr.c
…
bad_inode.c
…
binfmt_aout.c aout: move setup_arg_pages() prior to reading/mapping the binary 2012-03-05 13:51:32 -08:00
binfmt_elf.c regset: Prevent null pointer reference on readonly regsets 2012-03-02 11:38:15 -08:00
binfmt_elf_fdpic.c
…
binfmt_em86.c
…
binfmt_flat.c
…
binfmt_misc.c
…
binfmt_script.c
…
binfmt_som.c
…
bio-integrity.c
…
bio.c bio: don't overflow in bio_get_nr_vecs() 2012-02-08 22:07:18 +01:00
block_dev.c vfs: cache request_queue in struct block_device 2012-01-12 20:13:12 -08:00
buffer.c
…
char_dev.c
…
compat.c vfs: fix compat_sys_stat() handling of overflows in st_nlink 2012-02-13 20:45:39 -05:00
compat_binfmt_elf.c
…
compat_ioctl.c Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 2012-01-15 12:49:56 -08:00
dcache.c vfs: move dentry_cmp from <linux/dcache.h> to fs/dcache.c 2012-03-04 15:51:42 -08:00
dcookies.c
…
direct-io.c Restore direct_io / truncate locking API 2012-02-23 15:56:21 -08:00
drop_caches.c
…
eventfd.c
…
eventpoll.c epoll: ep_unregister_pollwait() can use the freed pwq->whead 2012-02-24 11:42:50 -08:00
exec.c coredump_wait: don't call complete_vfork_done() 2012-03-05 15:49:42 -08:00
fcntl.c
…
fhandle.c
…
fifo.c
…
file.c
…
file_table.c
…
filesystems.c
…
fs-writeback.c writeback: fix NULL bdi->dev in trace writeback_single_inode 2012-02-01 16:53:40 +08:00
fs_struct.c
…
generic_acl.c
…
inode.c vfs: fix panic in __d_lookup() with high dentry hashtable counts 2012-02-13 20:45:38 -05:00
internal.h
…
ioctl.c
…
ioprio.c block: strip out locking optimization in put_io_context() 2012-02-07 07:51:30 +01:00
libfs.c
…
locks.c
…
mbcache.c
…
mount.h
…
mpage.c fs: remove unneeded plug in mpage_readpages() 2012-01-12 09:19:54 +01:00
namei.c vfs: export full_name_hash() function to modules 2012-03-02 19:40:57 -08:00
namespace.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2012-01-08 13:21:22 -08:00
no-block.c
…
open.c
…
pipe.c pipe: fail cleanly when root tries F_SETPIPE_SZ with big size 2012-01-12 20:13:04 -08:00
pnode.c
…
pnode.h
…
posix_acl.c
…
proc_namespace.c
…
read_write.c
…
read_write.h
…
readdir.c
…
select.c sys_poll: fix incorrect type for 'timeout' parameter 2012-02-21 17:24:20 -08:00
seq_file.c
…
signalfd.c epoll: ep_unregister_pollwait() can use the freed pwq->whead 2012-02-24 11:42:50 -08:00
splice.c
…
stack.c
…
stat.c
…
statfs.c
…
super.c vfs: Provide function to get superblock and wait for it to thaw 2012-02-13 20:45:38 -05:00
sync.c
…
timerfd.c
…
utimes.c
…
xattr.c
…
xattr_acl.c
…