Patchwork [3.5.y.z,extended,stable] Patch "fs: Fix possible use-after-free with AIO" has been added to staging queue

mail settings
Submitter Luis Henriques
Date Feb. 28, 2013, 11:58 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/223933/
State New
Headers show


Luis Henriques - Feb. 28, 2013, 11:58 a.m.
This is a note to let you know that I have just added a patch titled

    fs: Fix possible use-after-free with AIO

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 354fcd5599fdcf83c2dc54b5e9eb7dd8b817b317 Mon Sep 17 00:00:00 2001
From: Jan Kara <>
Date: Wed, 30 Jan 2013 00:28:01 +0100
Subject: [PATCH] fs: Fix possible use-after-free with AIO

commit 54c807e71d5ac59dee56c685f2b66e27cd54c475 upstream.

Running AIO is pinning inode in memory using file reference. Once AIO
is completed using aio_complete(), file reference is put and inode can
be freed from memory. So we have to be sure that calling aio_complete()
is the last thing we do with the inode.

CC: Christoph Hellwig <>
CC: Jens Axboe <>
CC: Jeff Moyer <>
Acked-by: Jeff Moyer <>
Signed-off-by: Jan Kara <>
Signed-off-by: Al Viro <>
Signed-off-by: Luis Henriques <>
 fs/direct-io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)



diff --git a/fs/direct-io.c b/fs/direct-io.c
index 0c85fae..84466cb 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -261,9 +261,9 @@  static ssize_t dio_complete(struct dio *dio, loff_t offset, ssize_t ret, bool is
 		dio->end_io(dio->iocb, offset, transferred,
 			    dio->private, ret, is_async);
 	} else {
+		inode_dio_done(dio->inode);
 		if (is_async)
 			aio_complete(dio->iocb, ret, 0);
-		inode_dio_done(dio->inode);

 	return ret;