From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx1.redhat.com ([209.132.183.28]:58110 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757041AbcJQUEC (ORCPT ); Mon, 17 Oct 2016 16:04:02 -0400 From: Jeff Moyer To: Peter Zijlstra Cc: Christoph Hellwig , viro@zeniv.linux.org.uk, jack@suse.cz, dmonakhov@openvz.org, linux-fsdevel@vger.kernel.org, linux-aio@kvack.org, linux-kernel@vger.kernel.org, Oleg Nesterov , Mikulas Patocka Subject: Re: [PATCH] aio: fix a use after free (and fix freeze protection of aio writes) References: <1476597082-15317-1-git-send-email-hch@lst.de> <20161017185552.GA24653@lst.de> <20161017195454.GA3568@worktop.programming.kicks-ass.net> Date: Mon, 17 Oct 2016 16:04:00 -0400 In-Reply-To: <20161017195454.GA3568@worktop.programming.kicks-ass.net> (Peter Zijlstra's message of "Mon, 17 Oct 2016 21:54:54 +0200") Message-ID: MIME-Version: 1.0 Content-Type: text/plain Sender: linux-fsdevel-owner@vger.kernel.org List-ID: Peter Zijlstra writes: > On Mon, Oct 17, 2016 at 03:40:24PM -0400, Jeff Moyer wrote: >> Christoph Hellwig writes: >> >> > On Mon, Oct 17, 2016 at 02:19:47PM -0400, Jeff Moyer wrote: >> >> This ends up being a call to __sb_end_write: >> >> >> >> void __sb_end_write(struct super_block *sb, int level) >> >> { >> >> percpu_up_read(sb->s_writers.rw_sem + level-1); >> >> } >> >> >> >> Nothing guarantees that submission and completion happen on the same >> >> CPU. Is this safe? >> > >> > Good point. From my reading of the percpu_rwsem implementation it >> > is not safe to release it from a different CPU. Which makes me >> > wonder how we can protect aio writes properly here.. >> >> Could we just change percpu_rw_semaphore->read_count to be a signed >> integer? The down_write path sums up the counters from all cpus... > > To what point? Duh, nevermind. You're right, it should work as-is. -Jeff