Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes)

[Jeff Moyer]

Peter Zijlstra <peterz@xxxxxxxxxxxxx> writes:

> On Mon, Oct 17, 2016 at 03:40:24PM -0400, Jeff Moyer wrote:
>> Christoph Hellwig <hch@xxxxxx> writes:
>> 
>> > On Mon, Oct 17, 2016 at 02:19:47PM -0400, Jeff Moyer wrote:
>> >> This ends up being a call to __sb_end_write:
>> >> 
>> >> void __sb_end_write(struct super_block *sb, int level)
>> >> {
>> >>         percpu_up_read(sb->s_writers.rw_sem + level-1);
>> >> }
>> >> 
>> >> Nothing guarantees that submission and completion happen on the same
>> >> CPU.  Is this safe?
>> >
>> > Good point.  From my reading of the percpu_rwsem implementation it
>> > is not safe to release it from a different CPU.  Which makes me
>> > wonder how we can protect aio writes properly here..
>> 
>> Could we just change percpu_rw_semaphore->read_count to be a signed
>> integer?  The down_write path sums up the counters from all cpus...
>
> To what point?

Duh, nevermind.  You're right, it should work as-is.

-Jeff