• Tejun Heo's avatar
    fs/aio: Add explicit RCU grace period when freeing kioctx · a6d7cff4
    Tejun Heo authored
    While fixing refcounting, e34ecee2 ("aio: Fix a trinity splat")
    incorrectly removed explicit RCU grace period before freeing kioctx.
    The intention seems to be depending on the internal RCU grace periods
    of percpu_ref; however, percpu_ref uses a different flavor of RCU,
    sched-RCU.  This can lead to kioctx being freed while RCU read
    protected dereferences are still in progress.
    
    Fix it by updating free_ioctx() to go through call_rcu() explicitly.
    
    v2: Comment added to explain double bouncing.
    Signed-off-by: default avatarTejun Heo <tj@kernel.org>
    Reported-by: default avatarJann Horn <jannh@google.com>
    Fixes: e34ecee2 ("aio: Fix a trinity splat")
    Cc: Kent Overstreet <kent.overstreet@gmail.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: stable@vger.kernel.org # v3.13+
    a6d7cff4
aio.c 47.1 KB