ext4: fix possible use-after-free with AIO
authorJan Kara <jack@suse.cz>
Wed, 30 Jan 2013 03:48:17 +0000 (22:48 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 11 Mar 2014 23:10:05 +0000 (16:10 -0700)
commitb54e3acc375bf344c2273662c61ce0265969b5fd
tree8a3d1cf49ff9efe9ba0aab75b12b7937361f9c86
parent8a4188e2d84ab2ec720f29ede1799a6882969857
ext4: fix possible use-after-free with AIO

commit 091e26dfc156aeb3b73bc5c5f277e433ad39331c upstream.

Running AIO is pinning inode in memory using file reference. Once AIO
is completed using aio_complete(), file reference is put and inode can
be freed from memory. So we have to be sure that calling aio_complete()
is the last thing we do with the inode.

Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Acked-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/ext4/inode.c
fs/ext4/page-io.c