Patchwork [3.5.y.z,extended,stable] Patch "ocfs2: fix possible use-after-free with AIO" has been added to staging queue

mail settings
Submitter Luis Henriques
Date Feb. 28, 2013, 11:58 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/223936/
State New
Headers show


Luis Henriques - Feb. 28, 2013, 11:58 a.m.
This is a note to let you know that I have just added a patch titled

    ocfs2: fix possible use-after-free with AIO

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 58e57cc1da263b391d27bb4f37dc95b90cf47bcf Mon Sep 17 00:00:00 2001
From: Jan Kara <>
Date: Wed, 20 Feb 2013 13:16:39 +1100
Subject: [PATCH] ocfs2: fix possible use-after-free with AIO

commit 9b171e0c74ca0549d0610990a862dd895870f04a upstream.

Running AIO is pinning inode in memory using file reference. Once AIO
is completed using aio_complete(), file reference is put and inode can
be freed from memory. So we have to be sure that calling aio_complete()
is the last thing we do with the inode.

Signed-off-by: Jan Kara <>
Acked-by: Jeff Moyer <>
Acked-by: Joel Becker <>
Cc: Mark Fasheh <>
Cc: Al Viro <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Al Viro <>
Signed-off-by: Luis Henriques <>
 fs/ocfs2/aops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)



diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 6577432..340bd02 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -593,9 +593,9 @@  static void ocfs2_dio_end_io(struct kiocb *iocb,
 	level = ocfs2_iocb_rw_locked_level(iocb);
 	ocfs2_rw_unlock(inode, level);

+	inode_dio_done(inode);
 	if (is_async)
 		aio_complete(iocb, ret, 0);
-	inode_dio_done(inode);