From: Christoph Hellwig Date: Sun, 30 Oct 2016 16:42:01 +0000 (-0500) Subject: aio: hold an extra file reference over AIO read/write operations X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=0b944d3a4bba6b25f43aed530f4fa85c04d162a6;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git aio: hold an extra file reference over AIO read/write operations Otherwise we might dereference an already freed file and/or inode when aio_complete is called before we return from the read_iter or write_iter method. Signed-off-by: Christoph Hellwig Signed-off-by: Al Viro --- diff --git a/fs/aio.c b/fs/aio.c index 1157e13a36d6..0aa71d338c04 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1460,6 +1460,7 @@ rw_common: return ret; } + get_file(file); if (rw == WRITE) file_start_write(file); @@ -1467,6 +1468,7 @@ rw_common: if (rw == WRITE) file_end_write(file); + fput(file); kfree(iovec); break;