lkml.org 
[lkml]   [2018]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 3/6] aio: refactor read/write iocb setup
On Wed, Mar 28, 2018 at 09:26:36AM +0200, Christoph Hellwig wrote:
> + struct inode *inode = file_inode(file);
> +
> req->ki_flags |= IOCB_WRITE;
> file_start_write(file);
> - ret = aio_ret(req, call_write_iter(file, req, &iter));
> + ret = aio_rw_ret(req, call_write_iter(file, req, &iter));
> /*
> - * We release freeze protection in aio_complete(). Fool lockdep
> - * by telling it the lock got released so that it doesn't
> - * complain about held lock when we return to userspace.
> + * We release freeze protection in aio_complete_rw(). Fool
> + * lockdep by telling it the lock got released so that it
> + * doesn't complain about held lock when we return to userspace.
> */
> - if (S_ISREG(file_inode(file)->i_mode))
> - __sb_writers_release(file_inode(file)->i_sb, SB_FREEZE_WRITE);
> + if (S_ISREG(inode->i_mode))

... and that's another use-after-free, since we might've already done fput() of
that sucker by that point.

> + __sb_writers_release(inode->i_sb, SB_FREEZE_WRITE);

\
 
 \ /
  Last update: 2018-04-06 05:22    [W:0.189 / U:0.276 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site