A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 03:01:39 -04:00
Code Issues Projects Releases Packages Wiki Activity

aio: lookup_ioctx can return the wrong value when looking up a bogus context

Browse source 
The libaio test harness turned up a problem whereby lookup_ioctx on a
bogus io context was returning the 1 valid io context from the list
(harness/cases/3.p).

Because of that, an extra put_iocontext was done, and when the process
exited, it hit a BUG_ON in the put_iocontext macro called from exit_aio
(since we expect a users count of 1 and instead get 0).

The problem was introduced by "aio: make the lookup_ioctx() lockless"
(commit abf137dd77).

Thanks to Zach for pointing out that hlist_for_each_entry_rcu will not
return with a NULL tpos at the end of the loop, even if the entry was
not found.

Signed-off-by: Jeff Moyer <[email protected]>
Acked-by: Zach Brown <[email protected]>
Acked-by: Jens Axboe <[email protected]>
Cc: Benjamin LaHaise <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Jeff Moyer 2009-03-18 17:04:21 -07:00 • committed by Linus Torvalds
commit 65c24491b4
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
fs/aio.c
View file

@ -587,7 +587,7 @@ int aio_put_req(struct kiocb *req)
static struct kioctx *lookup_ioctx(unsigned long ctx_id)
{
struct mm_struct *mm = current->mm;
struct kioctx *ctx = NULL;
struct kioctx *ctx, *ret = NULL;
struct hlist_node *n;
rcu_read_lock();
@ -595,12 +595,13 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
hlist_for_each_entry_rcu(ctx, n, &mm->ioctx_list, list) {
if (ctx->user_id == ctx_id && !ctx->dead) {
get_ioctx(ctx);
ret = ctx;
break;
}
}
rcu_read_unlock();
return ctx;
return ret;
}
/*