hfsplus: Fix potential buffer overflows

[karo-tx-linux.git] / fs / aio.c

diff --git a/fs/aio.c b/fs/aio.c
index 4f71627264fd9276d6acb3b94f3ee5316372a394..67a6db3e1b6f83677009d2323c54dccd38dea63d 100644 (file)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -93,9 +93,8 @@ static void aio_free_ring(struct kioctx *ctx)
                put_page(info->ring_pages[i]);
 
        if (info->mmap_size) {
-               down_write(&ctx->mm->mmap_sem);
-               do_munmap(ctx->mm, info->mmap_base, info->mmap_size);
-               up_write(&ctx->mm->mmap_sem);
+               BUG_ON(ctx->mm != current->mm);
+               vm_munmap(info->mmap_base, info->mmap_size);
        }
 
        if (info->ring_pages && info->ring_pages != info->internal_pages)
@@ -305,15 +304,18 @@ out_freectx:
        return ERR_PTR(err);
 }
 
-/* aio_cancel_all
+/* kill_ctx
  *     Cancels all outstanding aio requests on an aio context.  Used 
  *     when the processes owning a context have all exited to encourage 
  *     the rapid destruction of the kioctx.
  */
-static void aio_cancel_all(struct kioctx *ctx)
+static void kill_ctx(struct kioctx *ctx)
 {
        int (*cancel)(struct kiocb *, struct io_event *);
+       struct task_struct *tsk = current;
+       DECLARE_WAITQUEUE(wait, tsk);
        struct io_event res;
+
        spin_lock_irq(&ctx->ctx_lock);
        ctx->dead = 1;
        while (!list_empty(&ctx->active_reqs)) {
@@ -329,15 +331,7 @@ static void aio_cancel_all(struct kioctx *ctx)
                        spin_lock_irq(&ctx->ctx_lock);
                }
        }
-       spin_unlock_irq(&ctx->ctx_lock);
-}
-
-static void wait_for_all_aios(struct kioctx *ctx)
-{
-       struct task_struct *tsk = current;
-       DECLARE_WAITQUEUE(wait, tsk);
 
-       spin_lock_irq(&ctx->ctx_lock);
        if (!ctx->reqs_active)
                goto out;
 
@@ -387,15 +381,24 @@ void exit_aio(struct mm_struct *mm)
                ctx = hlist_entry(mm->ioctx_list.first, struct kioctx, list);
                hlist_del_rcu(&ctx->list);
 
-               aio_cancel_all(ctx);
-
-               wait_for_all_aios(ctx);
+               kill_ctx(ctx);
 
                if (1 != atomic_read(&ctx->users))
                        printk(KERN_DEBUG
                                "exit_aio:ioctx still alive: %d %d %d\n",
                                atomic_read(&ctx->users), ctx->dead,
                                ctx->reqs_active);
+               /*
+                * We don't need to bother with munmap() here -
+                * exit_mmap(mm) is coming and it'll unmap everything.
+                * Since aio_free_ring() uses non-zero ->mmap_size
+                * as indicator that it needs to unmap the area,
+                * just set it to 0; aio_free_ring() is the only
+                * place that uses ->mmap_size, so it's safe.
+                * That way we get all munmap done to current->mm -
+                * all other callers have ctx->mm == current->mm.
+                */
+               ctx->ring_info.mmap_size = 0;
                put_ioctx(ctx);
        }
 }
@@ -1269,8 +1272,7 @@ static void io_destroy(struct kioctx *ioctx)
        if (likely(!was_dead))
                put_ioctx(ioctx);       /* twice for the list */
 
-       aio_cancel_all(ioctx);
-       wait_for_all_aios(ioctx);
+       kill_ctx(ioctx);
 
        /*
         * Wake up any waiters.  The setting of ctx->dead must be seen
@@ -1278,7 +1280,6 @@ static void io_destroy(struct kioctx *ioctx)
         * locking done by the above calls to ensure this consistency.
         */
        wake_up_all(&ioctx->wait);
-       put_ioctx(ioctx);       /* once for the lookup */
 }
 
 /* sys_io_setup:
@@ -1315,11 +1316,9 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
        ret = PTR_ERR(ioctx);
        if (!IS_ERR(ioctx)) {
                ret = put_user(ioctx->user_id, ctxp);
-               if (!ret) {
-                       put_ioctx(ioctx);
-                       return 0;
-               }
-               io_destroy(ioctx);
+               if (ret)
+                       io_destroy(ioctx);
+               put_ioctx(ioctx);
        }
 
 out:
@@ -1337,6 +1336,7 @@ SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
        struct kioctx *ioctx = lookup_ioctx(ctx);
        if (likely(NULL != ioctx)) {
                io_destroy(ioctx);
+               put_ioctx(ioctx);
                return 0;
        }
        pr_debug("EINVAL: io_destroy: invalid context id\n");