Oleg Nesterov <[email protected]> writes: > kill_ioctx() sets ctx->dead and removes ctx from ->ioctx_table > "atomically" under mm->ioctx_lock, so aio_ring_remap() can never > see a dead ctx. > > And even -EINVAL doesn't look necessary. Yes, if mremap() races > with kill_ioctx() vm_munmap(ctx->mmap_base, ctx->mmap_size) can > unmap the wrong region. In this case the buggy application should > blame itself. And there are other reasons why that vm_munmap() can > be wrong. Say, an application can mremap() the part of aio region > and then do io_destroy(). We could change aio_ring_remap() to > verify vma->that vma_end - vma->vma_start == ctx->mmap_size but > this won't help if the application does munmap() instead.
I don't think this paragraph really fits with the patch. It's interesting commentary, but if you feel strongly enough about it, send a patch that undoes b2edffdd912b. ;-) So, drop that paragraph from the commit message, and you can add my reviewed by. The patch itself looks good to me. Cheers, Jeff > > Signed-off-by: Oleg Nesterov <[email protected]> > --- > fs/aio.c | 9 +++------ > 1 files changed, 3 insertions(+), 6 deletions(-) > > diff --git a/fs/aio.c b/fs/aio.c > index 480440f..893d300 100644 > --- a/fs/aio.c > +++ b/fs/aio.c > @@ -325,14 +325,11 @@ static int aio_ring_remap(struct file *file, struct > vm_area_struct *vma) > rcu_read_lock(); > table = rcu_dereference(mm->ioctx_table); > for (i = 0; i < table->nr; i++) { > - struct kioctx *ctx; > + struct kioctx *ctx = table->table[i]; > > - ctx = table->table[i]; > if (ctx && ctx->aio_ring_file == file) { > - if (!atomic_read(&ctx->dead)) { > - ctx->user_id = ctx->mmap_base = vma->vm_start; > - res = 0; > - } > + ctx->user_id = ctx->mmap_base = vma->vm_start; > + res = 0; > break; > } > } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
