Messages in this thread Patch in this message |  | | From | Christoph Hellwig <> | Subject | [PATCH 1/4] aio: hold an extra file reference over AIO read/write operations | Date | Sun, 30 Oct 2016 11:42:01 -0500 |
| |
Otherwise we might dereference an already freed file and/or inode when aio_complete is called before we return from the read_iter or write_iter method.
Signed-off-by: Christoph Hellwig <hch@lst.de> --- fs/aio.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/fs/aio.c b/fs/aio.c index 1157e13..0aa71d3 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1460,6 +1460,7 @@ static ssize_t aio_run_iocb(struct kiocb *req, unsigned opcode, return ret; } + get_file(file); if (rw == WRITE) file_start_write(file); @@ -1467,6 +1468,7 @@ static ssize_t aio_run_iocb(struct kiocb *req, unsigned opcode, if (rw == WRITE) file_end_write(file); + fput(file); kfree(iovec); break; -- 2.1.4
|  |