Skip to contentSkip to conversation

Patch "fs/aio: Use RCU accessors for kioctx_table->table[]" has been added to the 3.18-stable tree

PATCH [email protected] 1 participant 1 message Mar 19, 2018

Subsystems (3)
Stable branch VFS Aio
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

    fs/aio: Use RCU accessors for kioctx_table->table[]

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
fs-aio-use-rcu-accessors-for-kioctx_table-table.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From d0264c01e7587001a8c4608a5d1818dba9a4c11a Mon Sep 17 00:00:00 2001

From: Tejun Heo <[email protected]>
Date: Wed, 14 Mar 2018 12:10:17 -0700
Subject: fs/aio: Use RCU accessors for kioctx_table->table[]

From: Tejun Heo <[email protected]>

commit d0264c01e7587001a8c4608a5d1818dba9a4c11a upstream.

While converting ioctx index from a list to a table, db446a08c23d ("aio: convert the ioctx list to table lookup v3") missed tagging kioctx_table->table[] as an array of RCU pointers and using the appropriate RCU accessors. This introduces a small window in the lookup path where init and access may race.

Mark kioctx_table->table[] with __rcu and use the approriate RCU accessors when using the field.

Signed-off-by Tejun Heo <[email protected]>
Reported-by Jann Horn <[email protected]>
Fixes db446a08c23d ("aio: convert the ioctx list to table lookup v3")
Cc Benjamin LaHaise <[email protected]>
Cc Linus Torvalds <[email protected]>
Cc [email protected] # v3.12+
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 fs/aio.c |   19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)
fs/aio.c +10 -9
@@ -68,9 +68,9 @@ struct aio_ring {
 #define AIO_RING_PAGES	8
 
 struct kioctx_table {
-	struct rcu_head	rcu;
-	unsigned	nr;
-	struct kioctx	*table[];
+	struct rcu_head		rcu;
+	unsigned		nr;
+	struct kioctx __rcu	*table[];
 };
 
 struct kioctx_cpu {

@@ -583,9 +583,9 @@ static int ioctx_add_table(struct kioctx
 	while (1) {
 		if (table)
 			for (i = 0; i < table->nr; i++)
-				if (!table->table[i]) {
+				if (!rcu_access_pointer(table->table[i])) {
 					ctx->id = i;
-					table->table[i] = ctx;
+					rcu_assign_pointer(table->table[i], ctx);
 					spin_unlock(&mm->ioctx_lock);
 
 					/* While kioctx setup is in progress,

@@ -760,8 +760,8 @@ static int kill_ioctx(struct mm_struct *
 
 	spin_lock(&mm->ioctx_lock);
 	table = rcu_dereference_raw(mm->ioctx_table);
-	WARN_ON(ctx != table->table[ctx->id]);
-	table->table[ctx->id] = NULL;
+	WARN_ON(ctx != rcu_access_pointer(table->table[ctx->id]));
+	RCU_INIT_POINTER(table->table[ctx->id], NULL);
 	spin_unlock(&mm->ioctx_lock);
 
 	/* free_ioctx_reqs() will do the necessary RCU synchronization */

@@ -817,7 +817,8 @@ void exit_aio(struct mm_struct *mm)
 		return;
 
 	for (i = 0; i < table->nr; ++i) {
-		struct kioctx *ctx = table->table[i];
+		struct kioctx *ctx =
+			rcu_dereference_protected(table->table[i], true);
 		struct completion requests_done =
 			COMPLETION_INITIALIZER_ONSTACK(requests_done);
 

@@ -1003,7 +1004,7 @@ static struct kioctx *lookup_ioctx(unsig
 	if (!table || id >= table->nr)
 		goto out;
 
-	ctx = table->table[id];
+	ctx = rcu_dereference(table->table[id]);
 	if (ctx && ctx->user_id == ctx_id) {
 		percpu_ref_get(&ctx->users);
 		ret = ctx;

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/fs-aio-add-explicit-rcu-grace-period-when-freeing-kioctx.patch queue-3.18/fs-aio-use-rcu-accessors-for-kioctx_table-table.patch