Wrapfs: protect lower_file by ref-count during aio operation

Signed-off-by: Erez Zadok <ezk@cs.sunysb.edu>
Signed-off-by: Mengyang Li <li.mengyang@stonybrook.edu>

diff --git a/fs/wrapfs/file.c b/fs/wrapfs/file.c
index 79b34fb310a9cb82b9bec9902144e4782f575355..45fbb1e0c2ecd49f231b39026d295a2d03332878 100644 (file)
--- a/fs/wrapfs/file.c
+++ b/fs/wrapfs/file.c
@@ -277,9 +277,11 @@ static ssize_t wrapfs_aio_read(struct kiocb *iocb, const struct iovec *iov,
         * It appears safe to rewrite this iocb, because in
         * do_io_submit@fs/aio.c, iocb is a just copy from user.
         */
+       get_file(lower_file); /* prevent lower_file from being released */
        iocb->ki_filp = lower_file;
        err = lower_file->f_op->aio_read(iocb, iov, nr_segs, pos);
        iocb->ki_filp = file;
+       fput(lower_file);
 out:
        return err;
 }
@@ -298,9 +300,11 @@ static ssize_t wrapfs_aio_write(struct kiocb *iocb, const struct iovec *iov,
         * It appears safe to rewrite this iocb, because in
         * do_io_submit@fs/aio.c, iocb is a just copy from user.
         */
+       get_file(lower_file); /* prevent lower_file from being released */
        iocb->ki_filp = lower_file;
        err = lower_file->f_op->aio_write(iocb, iov, nr_segs, pos);
        iocb->ki_filp = file;
+       fput(lower_file);
 out:
        return err;
 }