From: Theodore Ts'o Date: Mon, 12 Dec 2011 15:53:02 +0000 (-0500) Subject: ext4: fix ext4_end_io_dio() racing against fsync() X-Git-Tag: v3.1.6~13 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6415da6d18a55702cee3f01662733d0501635bbc;p=thirdparty%2Fkernel%2Fstable.git ext4: fix ext4_end_io_dio() racing against fsync() commit b5a7e97039a80fae673ccc115ce595d5b88fb4ee upstream. We need to make sure iocb->private is cleared *before* we put the io_end structure on i_completed_io_list. Otherwise fsync() could potentially run on another CPU and free the iocb structure out from under us. Reported-by: Kent Overstreet Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman --- diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index b644b9c164a7b..00de8e8a133dc 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2630,10 +2630,11 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset, iocb->private, io_end->inode->i_ino, iocb, offset, size); + iocb->private = NULL; + /* if not aio dio with unwritten extents, just free io and return */ if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) { ext4_free_io_end(io_end); - iocb->private = NULL; out: if (is_async) aio_complete(iocb, ret, 0); @@ -2656,7 +2657,6 @@ out: spin_unlock_irqrestore(&ei->i_completed_io_lock, flags); /* queue the work to convert unwritten extents to written */ - iocb->private = NULL; queue_work(wq, &io_end->work); /* XXX: probably should move into the real I/O completion handler */