summaryrefslogtreecommitdiffstats
path: root/fs/aio.c
diff options
context:
space:
mode:
authorChristoph Hellwig <hch@lst.de>2016-10-30 11:42:01 -0500
committerAl Viro <viro@zeniv.linux.org.uk>2016-10-30 13:09:42 -0400
commit0b944d3a4bba6b25f43aed530f4fa85c04d162a6 (patch)
treec5c7b8fc2ec3fe80e12de1e3a8bdb65aa04b2169 /fs/aio.c
parenta909d3e636995ba7c349e2ca5dbb528154d4ac30 (diff)
downloadlinux-stable-0b944d3a4bba6b25f43aed530f4fa85c04d162a6.tar.gz
linux-stable-0b944d3a4bba6b25f43aed530f4fa85c04d162a6.tar.bz2
linux-stable-0b944d3a4bba6b25f43aed530f4fa85c04d162a6.zip
aio: hold an extra file reference over AIO read/write operations
Otherwise we might dereference an already freed file and/or inode when aio_complete is called before we return from the read_iter or write_iter method. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/aio.c')
-rw-r--r--fs/aio.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/aio.c b/fs/aio.c
index 1157e13a36d6..0aa71d338c04 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1460,6 +1460,7 @@ rw_common:
return ret;
}
+ get_file(file);
if (rw == WRITE)
file_start_write(file);
@@ -1467,6 +1468,7 @@ rw_common:
if (rw == WRITE)
file_end_write(file);
+ fput(file);
kfree(iovec);
break;