[ 3.5.y.z extended stable ] Patch "ext4: fix possible use-after-free with AIO" has been added to staging queue

Luis Henriques luis.henriques at canonical.com
Thu Feb 28 11:57:27 UTC 2013

This is a note to let you know that I have just added a patch titled

    ext4: fix possible use-after-free with AIO

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:


If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



>From 5b420acb3b0b9d0f9b886c2409ff80a0e5613bd4 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack at suse.cz>
Date: Tue, 29 Jan 2013 22:48:17 -0500
Subject: [PATCH] ext4: fix possible use-after-free with AIO

commit 091e26dfc156aeb3b73bc5c5f277e433ad39331c upstream.

Running AIO is pinning inode in memory using file reference. Once AIO
is completed using aio_complete(), file reference is put and inode can
be freed from memory. So we have to be sure that calling aio_complete()
is the last thing we do with the inode.

Reviewed-by: Carlos Maiolino <cmaiolino at redhat.com>
Acked-by: Jeff Moyer <jmoyer at redhat.com>
Signed-off-by: Jan Kara <jack at suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
[ luis: adjust context ]
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
 fs/ext4/inode.c   |  2 +-
 fs/ext4/page-io.c | 10 ++++------
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 20b2687..0589bb2 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2867,9 +2867,9 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
 	if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) {
+		inode_dio_done(inode);
 		if (is_async)
 			aio_complete(iocb, ret, 0);
-		inode_dio_done(inode);

diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index dcdeef1..7e04138 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -106,15 +106,13 @@ int ext4_end_io_nolock(ext4_io_end_t *io)
 			 "(inode %lu, offset %llu, size %zd, error %d)",
 			 inode->i_ino, offset, size, ret);
-	if (io->iocb)
-		aio_complete(io->iocb, io->result, 0);
-	if (io->flag & EXT4_IO_END_DIRECT)
-		inode_dio_done(inode);
 	/* Wake up anyone waiting on unwritten extent conversion */
 	if (atomic_dec_and_test(&EXT4_I(inode)->i_aiodio_unwritten))
+	if (io->flag & EXT4_IO_END_DIRECT)
+		inode_dio_done(inode);
+	if (io->iocb)
+		aio_complete(io->iocb, io->result, 0);
 	return ret;


More information about the kernel-team mailing list