aio: fix rcu ioctx lookup
authorNick Piggin <npiggin@gmail.com>
Fri, 25 Feb 2011 22:44:26 +0000 (14:44 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 25 Feb 2011 23:07:37 +0000 (15:07 -0800)
commit3bd9a5d734c7cc7533b27abf451416c7f50095a7
tree357fc4ec95d7163cb96891151df51f6d7d130d0a
parent29723fccc837d20039078f7a571e8d457eb0d6c6
aio: fix rcu ioctx lookup

aio-dio-invalidate-failure GPFs in aio_put_req from io_submit.

lookup_ioctx doesn't implement the rcu lookup pattern properly.
rcu_read_lock does not prevent refcount going to zero, so we might take
a refcount on a zero count ioctx.

Fix the bug by atomically testing for zero refcount before incrementing.

[jack@suse.cz: added comment into the code]
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Nick Piggin <npiggin@kernel.dk>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/aio.c