Skip to main content

Browse the archive

https://github.com/torvalds/linux
23 October 2021, 00:29:24 UTC
Revision 7137c6bd455234bcb7560fd829e6ee49cae5fed6 authored by Jan Kara on 25 February 2011, 22:44:27 UTC, committed by Linus Torvalds on 25 February 2011, 23:07:37 UTC 
aio: fix race between io_destroy() and io_submit()
 
A race can occur when io_submit() races with io_destroy():

 CPU1						CPU2
io_submit()
  do_io_submit()
    ...
    ctx = lookup_ioctx(ctx_id);
						io_destroy()
    Now do_io_submit() holds the last reference to ctx.
    ...
    queue new AIO
    put_ioctx(ctx) - frees ctx with active AIOs

We solve this issue by checking whether ctx is being destroyed in AIO
submission path after adding new AIO to ctx.  Then we are guaranteed that
either io_destroy() waits for new AIO or we see that ctx is being
destroyed and bail out.

Cc: Nick Piggin <npiggin@kernel.dk>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 3bd9a5d
History
Tip revision: 7137c6bd455234bcb7560fd829e6ee49cae5fed6 authored by Jan Kara on 25 February 2011, 22:44:27 UTC
aio: fix race between io_destroy() and io_submit()
Tip revision: 7137c6b
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 941 bytes
.mailmap -rw-r--r-- 4.0 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 91.7 KB
Kbuild -rw-r--r-- 2.4 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 187.0 KB
Makefile -rw-r--r-- 50.9 KB
README -rw-r--r-- 17.1 KB
REPORTING-BUGS -rw-r--r-- 3.3 KB

README

back to top