fs/aio: Add explicit RCU grace period when freeing kioctx
authorTejun Heo <tj@kernel.org>
Wed, 14 Mar 2018 19:10:17 +0000 (12:10 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 21 Mar 2018 11:06:43 +0000 (12:06 +0100)
commit076c7c06801a71035c077ea3f621fc9d33a51a9b
tree56436aaf1e38ffa0c840d2c36ddd49a5df8a0c3b
parentb071bce3ff7eda34c4e4aa9f5d39067b9db33dd8
fs/aio: Add explicit RCU grace period when freeing kioctx

commit a6d7cff472eea87d96899a20fa718d2bab7109f3 upstream.

While fixing refcounting, e34ecee2ae79 ("aio: Fix a trinity splat")
incorrectly removed explicit RCU grace period before freeing kioctx.
The intention seems to be depending on the internal RCU grace periods
of percpu_ref; however, percpu_ref uses a different flavor of RCU,
sched-RCU.  This can lead to kioctx being freed while RCU read
protected dereferences are still in progress.

Fix it by updating free_ioctx() to go through call_rcu() explicitly.

v2: Comment added to explain double bouncing.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Jann Horn <jannh@google.com>
Fixes: e34ecee2ae79 ("aio: Fix a trinity splat")
Cc: Kent Overstreet <kent.overstreet@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@vger.kernel.org # v3.13+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/aio.c