From 865ddbd9c62f7fee55e544d0f9e48c354dc6be7b Mon Sep 17 00:00:00 2001 From: Erez Zadok Date: Sun, 10 Aug 2014 00:40:56 -0400 Subject: [PATCH] Wrapfs: protect lower_file by ref-count during aio operation Signed-off-by: Erez Zadok Signed-off-by: Mengyang Li --- fs/wrapfs/file.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/wrapfs/file.c b/fs/wrapfs/file.c index 6086cce83a50..e8242a80844c 100644 --- a/fs/wrapfs/file.c +++ b/fs/wrapfs/file.c @@ -279,9 +279,11 @@ static ssize_t wrapfs_aio_read(struct kiocb *iocb, const struct iovec *iov, * It appears safe to rewrite this iocb, because in * do_io_submit@fs/aio.c, iocb is a just copy from user. */ + get_file(lower_file); /* prevent lower_file from being released */ iocb->ki_filp = lower_file; err = lower_file->f_op->aio_read(iocb, iov, nr_segs, pos); iocb->ki_filp = file; + fput(lower_file); out: return err; } @@ -300,9 +302,11 @@ static ssize_t wrapfs_aio_write(struct kiocb *iocb, const struct iovec *iov, * It appears safe to rewrite this iocb, because in * do_io_submit@fs/aio.c, iocb is a just copy from user. */ + get_file(lower_file); /* prevent lower_file from being released */ iocb->ki_filp = lower_file; err = lower_file->f_op->aio_write(iocb, iov, nr_segs, pos); iocb->ki_filp = file; + fput(lower_file); out: return err; } -- 2.34.1