Received: by 10.213.65.68 with SMTP id h4csp1747973imn; Mon, 19 Mar 2018 12:09:55 -0700 (PDT) X-Google-Smtp-Source: AG47ELsLBaM2Yu8J+EADRujsHODIOY+hzAVkfKam9Lr9m2HFvVzr6p3VFYIL4L2vcYxBDz+tdS+t X-Received: by 2002:a17:902:50ec:: with SMTP id c41-v6mr13167612plj.208.1521486595092; Mon, 19 Mar 2018 12:09:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1521486595; cv=none; d=google.com; s=arc-20160816; b=Wpo+0f5V0k2nf+0+PCypD8+lPxJ7OYsOQd9v68IJ97GiefP4FmSeRWfD5vniRU1Njn CX9qn2XyO8PtSGHMTh6aYXakZnOwPBdklgnHlUHVEl46gCTQJ2uhcTDf5UEzs2NsQG8p b5c/Ba1pQramaBkF0B+VaCmP+ZnedPEqLIc17I0JqRlG1wznOMIf4gwD4oU5W7dN8CWf bS6bG1dC8gf40UDxslcXkHeGqXt4f7mNUHKGAzmV9EH1U/KLG6nyJPjZs1jA7FlzMbwO EyDHoq1AH7rNArrTiLsHuD7RWTaea5Skiy7EWCrWHf33ygsf2D2Rc+rDG4T/vrXrG86u WB0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=8FCd8tKUeK8yAC+58onESIWJhTjEqtrEI8ZB7pfjklk=; b=rKOL+4JaalvL9DSzGKWAdQ0ehKDZtcX+i70cabHqz3/K/hUb0uVXuSEsxjBxfN2irg FNRzg91k3vuHITezhX+FDk8DT8YOcoHuX5QW0bsxnaiEIIKAEqzIw/7bK5loYE1GaiVc T1a1rnF59zHuNAuAZqv4n+aUwMKoL9gs87juNYNQjy7BpbiYpNzSmz6B6viZQzuhdMzB dkNJbM/Q7lUTYi5FHOKYnQSohyOV//5K4RTLrf5qWpKt8vuOp75z3K/msL7qpQ84TrEf 06U8EsF1KOE9cYfZvt9YM1qnBn5Q5VYPkrLRBhyx+5kRa99CT7CLOfAeWxDAfybzFDOO SA1w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u25si333362pgn.488.2018.03.19.12.09.40; Mon, 19 Mar 2018 12:09:55 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935626AbeCSTIM (ORCPT + 99 others); Mon, 19 Mar 2018 15:08:12 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:51544 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965748AbeCSS2O (ORCPT ); Mon, 19 Mar 2018 14:28:14 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 5369E12AE; Mon, 19 Mar 2018 18:28:13 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tejun Heo , Jann Horn , Kent Overstreet , Linus Torvalds Subject: [PATCH 4.9 230/241] fs/aio: Add explicit RCU grace period when freeing kioctx Date: Mon, 19 Mar 2018 19:08:15 +0100 Message-Id: <20180319180800.691401226@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180319180751.172155436@linuxfoundation.org> References: <20180319180751.172155436@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tejun Heo commit a6d7cff472eea87d96899a20fa718d2bab7109f3 upstream. While fixing refcounting, e34ecee2ae79 ("aio: Fix a trinity splat") incorrectly removed explicit RCU grace period before freeing kioctx. The intention seems to be depending on the internal RCU grace periods of percpu_ref; however, percpu_ref uses a different flavor of RCU, sched-RCU. This can lead to kioctx being freed while RCU read protected dereferences are still in progress. Fix it by updating free_ioctx() to go through call_rcu() explicitly. v2: Comment added to explain double bouncing. Signed-off-by: Tejun Heo Reported-by: Jann Horn Fixes: e34ecee2ae79 ("aio: Fix a trinity splat") Cc: Kent Overstreet Cc: Linus Torvalds Cc: stable@vger.kernel.org # v3.13+ Signed-off-by: Greg Kroah-Hartman --- fs/aio.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) --- a/fs/aio.c +++ b/fs/aio.c @@ -115,7 +115,8 @@ struct kioctx { struct page **ring_pages; long nr_pages; - struct work_struct free_work; + struct rcu_head free_rcu; + struct work_struct free_work; /* see free_ioctx() */ /* * signals when all in-flight requests are done @@ -581,6 +582,12 @@ static int kiocb_cancel(struct aio_kiocb return cancel(&kiocb->common); } +/* + * free_ioctx() should be RCU delayed to synchronize against the RCU + * protected lookup_ioctx() and also needs process context to call + * aio_free_ring(), so the double bouncing through kioctx->free_rcu and + * ->free_work. + */ static void free_ioctx(struct work_struct *work) { struct kioctx *ctx = container_of(work, struct kioctx, free_work); @@ -594,6 +601,14 @@ static void free_ioctx(struct work_struc kmem_cache_free(kioctx_cachep, ctx); } +static void free_ioctx_rcufn(struct rcu_head *head) +{ + struct kioctx *ctx = container_of(head, struct kioctx, free_rcu); + + INIT_WORK(&ctx->free_work, free_ioctx); + schedule_work(&ctx->free_work); +} + static void free_ioctx_reqs(struct percpu_ref *ref) { struct kioctx *ctx = container_of(ref, struct kioctx, reqs); @@ -602,8 +617,8 @@ static void free_ioctx_reqs(struct percp if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count)) complete(&ctx->rq_wait->comp); - INIT_WORK(&ctx->free_work, free_ioctx); - schedule_work(&ctx->free_work); + /* Synchronize against RCU protected table->table[] dereferences */ + call_rcu(&ctx->free_rcu, free_ioctx_rcufn); } /* @@ -825,7 +840,7 @@ static int kill_ioctx(struct mm_struct * table->table[ctx->id] = NULL; spin_unlock(&mm->ioctx_lock); - /* percpu_ref_kill() will do the necessary call_rcu() */ + /* free_ioctx_reqs() will do the necessary RCU synchronization */ wake_up_all(&ctx->wait); /*