From patchwork Wed Nov 30 20:53:48 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Theodore Ts'o X-Patchwork-Id: 128570 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 27E771007D1 for ; Thu, 1 Dec 2011 07:53:57 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752541Ab1K3Uxz (ORCPT ); Wed, 30 Nov 2011 15:53:55 -0500 Received: from li9-11.members.linode.com ([67.18.176.11]:53951 "EHLO test.thunk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752483Ab1K3Uxz (ORCPT ); Wed, 30 Nov 2011 15:53:55 -0500 Received: from root (helo=tytso-glaptop.cam.corp.google.com) by test.thunk.org with local-esmtp (Exim 4.69) (envelope-from ) id 1RVrA9-00070I-Eu; Wed, 30 Nov 2011 20:53:53 +0000 Received: from tytso by tytso-glaptop.cam.corp.google.com with local (Exim 4.71) (envelope-from ) id 1RVrA4-0004cU-O5; Wed, 30 Nov 2011 15:53:48 -0500 From: Theodore Ts'o To: Ext4 Developers List Cc: curtw@google.com, Theodore Ts'o Subject: [PATCH] ext4: fix ext4_end_io_dio() racing against fsync() Date: Wed, 30 Nov 2011 15:53:48 -0500 Message-Id: <1322686428-17728-1-git-send-email-tytso@mit.edu> X-Mailer: git-send-email 1.7.4.1.22.gec8e1.dirty X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: tytso@thunk.org X-SA-Exim-Scanned: No (on test.thunk.org); SAEximRunCond expanded to false Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org We need to make sure iocb->private is cleared *before* we put the io_end structure on i_completed_io_list. Otherwise fsync() could potentially run on another CPU and free the iocb structure out from under us. Reported-by: Kent Overstreet Signed-off-by: "Theodore Ts'o" --- fs/ext4/inode.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 848f436..d2c8663 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2781,10 +2781,11 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset, iocb->private, io_end->inode->i_ino, iocb, offset, size); + iocb->private = NULL; + /* if not aio dio with unwritten extents, just free io and return */ if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) { ext4_free_io_end(io_end); - iocb->private = NULL; out: if (is_async) aio_complete(iocb, ret, 0); @@ -2807,7 +2808,6 @@ out: spin_unlock_irqrestore(&ei->i_completed_io_lock, flags); /* queue the work to convert unwritten extents to written */ - iocb->private = NULL; queue_work(wq, &io_end->work); /* XXX: probably should move into the real I/O completion handler */