Messages in this thread |  | | Date | Sat, 29 Oct 2016 13:24:51 +0100 | From | Al Viro <> | Subject | Re: [PATCH] aio: fix a user triggered use after free (and fix freeze protection of aio writes) |
| |
On Sat, Oct 29, 2016 at 09:44:29AM +0200, Christoph Hellwig wrote:
> - if (rw == WRITE) > + if (rw == WRITE) { > file_start_write(file); > + req->ki_flags |= IOCB_WRITE; > + }
> + if (rw == WRITE) { > + /* > + * We release freeze protection in aio_complete(). Fool > + * lockdep by telling it the lock got released so that > + * it doesn't complain about held lock when we return > + * to userspace. > + */ > + __sb_writers_release(file_inode(file)->i_sb, > + SB_FREEZE_WRITE); > + }
How about taking this chunk (i.e. telling lockdep that we are not holding this thing) past the iter_op() call, where file_end_write() used to be?
As it is, you risk hiding the lock dependencies the current mainline would've caught. Other than that I see no problems with the patch...
|  |