Patchwork [3.5.y.z,extended,stable] Patch "xfs: Fix possible use-after-free with AIO" has been added to staging queue

mail settings
Submitter Herton Ronaldo Krzesinski
Date Jan. 31, 2013, 10:11 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/217293/
State New
Headers show


Herton Ronaldo Krzesinski - Jan. 31, 2013, 10:11 p.m.
This is a note to let you know that I have just added a patch titled

    xfs: Fix possible use-after-free with AIO

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 4bf193f525ba48ec92bd710b6f2298c24f6c83a6 Mon Sep 17 00:00:00 2001
From: Jan Kara <>
Date: Wed, 23 Jan 2013 13:56:18 +0100
Subject: [PATCH] xfs: Fix possible use-after-free with AIO

commit 4b05d09c18d9aa62d2e7fb4b057f54e5a38963f5 upstream.

Running AIO is pinning inode in memory using file reference. Once AIO
is completed using aio_complete(), file reference is put and inode can
be freed from memory. So we have to be sure that calling aio_complete()
is the last thing we do with the inode.

CC: Ben Myers <>
Signed-off-by: Jan Kara <>
Reviewed-by: Ben Myers <>
Signed-off-by: Ben Myers <>
Signed-off-by: Herton Ronaldo Krzesinski <>
 fs/xfs/xfs_aops.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)



diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 8dad722..6868548 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -86,11 +86,11 @@  xfs_destroy_ioend(

 	if (ioend->io_iocb) {
+		inode_dio_done(ioend->io_inode);
 		if (ioend->io_isasync) {
 			aio_complete(ioend->io_iocb, ioend->io_error ?
 					ioend->io_error : ioend->io_result, 0);
-		inode_dio_done(ioend->io_inode);

 	mempool_free(ioend, xfs_ioend_pool);