linux-toradex.git/fs/aio.c, branch v4.9.58

aio: fix lock dep warning

2017-07-05T12:40:26+00:00

[ Upstream commit a12f1ae61c489076a9aeb90bddca7722bf330df3 ]

lockdep reports a warnning. file_start_write/file_end_write only
acquire/release the lock for regular files. So checking the files in aio
side too.

[  453.532141] ------------[ cut here ]------------
[  453.533011] WARNING: CPU: 1 PID: 1298 at ../kernel/locking/lockdep.c:3514 lock_release+0x434/0x670
[  453.533011] DEBUG_LOCKS_WARN_ON(depth <= 0)
[  453.533011] Modules linked in:
[  453.533011] CPU: 1 PID: 1298 Comm: fio Not tainted 4.9.0+ #964
[  453.533011] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.0-1.fc24 04/01/2014
[  453.533011]  ffff8803a24b7a70 ffffffff8196cffb ffff8803a24b7ae8 0000000000000000
[  453.533011]  ffff8803a24b7ab8 ffffffff81091ee1 ffff8803a5dba700 00000dba00000008
[  453.533011]  ffffed0074496f59 ffff8803a5dbaf54 ffff8803ae0f8488 fffffffffffffdef
[  453.533011] Call Trace:
[  453.533011]  [] dump_stack+0x67/0x9c
[  453.533011]  [] __warn+0x111/0x130
[  453.533011]  [] warn_slowpath_fmt+0x97/0xb0
[  453.533011]  [] ? __warn+0x130/0x130
[  453.533011]  [] ? blk_finish_plug+0x29/0x60
[  453.533011]  [] lock_release+0x434/0x670
[  453.533011]  [] ? import_single_range+0xd4/0x110
[  453.533011]  [] ? rw_verify_area+0x65/0x140
[  453.533011]  [] ? aio_write+0x1f6/0x280
[  453.533011]  [] aio_write+0x229/0x280
[  453.533011]  [] ? aio_complete+0x640/0x640
[  453.533011]  [] ? debug_check_no_locks_freed+0x1a0/0x1a0
[  453.533011]  [] ? debug_lockdep_rcu_enabled.part.2+0x1a/0x30
[  453.533011]  [] ? debug_lockdep_rcu_enabled+0x35/0x40
[  453.533011]  [] ? __might_fault+0x7e/0xf0
[  453.533011]  [] do_io_submit+0x94c/0xb10
[  453.533011]  [] ? do_io_submit+0x23e/0xb10
[  453.533011]  [] ? SyS_io_destroy+0x270/0x270
[  453.533011]  [] ? mark_held_locks+0x23/0xc0
[  453.533011]  [] ? trace_hardirqs_on_thunk+0x1a/0x1c
[  453.533011]  [] SyS_io_submit+0x10/0x20
[  453.533011]  [] entry_SYSCALL_64_fastpath+0x18/0xad
[  453.533011]  [] ? trace_hardirqs_off_caller+0xc0/0x110
[  453.533011] ---[ end trace b2fbe664d1cc0082 ]---

Cc: Dmitry Monakhov 
Cc: Jan Kara 
Cc: Christoph Hellwig 
Cc: Al Viro 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Shaohua Li 
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

aio: fix freeze protection of aio writes

2016-10-30T17:09:42+00:00

Currently we dropped freeze protection of aio writes just after IO was
submitted. Thus aio write could be in flight while the filesystem was
frozen and that could result in unexpected situation like aio completion
wanting to convert extent type on frozen filesystem. Testcase from
Dmitry triggering this is like:

for ((i=0;i<60;i++));do fsfreeze -f /mnt ;sleep 1;fsfreeze -u /mnt;done &
fio --bs=4k --ioengine=libaio --iodepth=128 --size=1g --direct=1 \
    --runtime=60 --filename=/mnt/file --name=rand-write --rw=randwrite

Fix the problem by dropping freeze protection only once IO is completed
in aio_complete().

Reported-by: Dmitry Monakhov 
Signed-off-by: Jan Kara 
[hch: forward ported on top of various VFS and aio changes]
Signed-off-by: Christoph Hellwig 
Signed-off-by: Al Viro

fs: remove aio_run_iocb

2016-10-30T17:09:42+00:00

Pass the ABI iocb structure to aio_setup_rw and let it handle the
non-vectored I/O case as well.  With that and a new helper for the AIO
return value handling we can now define new aio_read and aio_write
helpers that implement reads and writes in a self-contained way without
duplicating too much code.

Signed-off-by: Christoph Hellwig 
Signed-off-by: Al Viro

fs: remove the never implemented aio_fsync file operation

2016-10-30T17:09:42+00:00

Signed-off-by: Christoph Hellwig 
Signed-off-by: Al Viro

aio: hold an extra file reference over AIO read/write operations

2016-10-30T17:09:42+00:00

Otherwise we might dereference an already freed file and/or inode
when aio_complete is called before we return from the read_iter or
write_iter method.

Signed-off-by: Christoph Hellwig 
Signed-off-by: Al Viro

fs/aio.c: eliminate redundant loads in put_aio_ring_file

2016-09-28T01:45:46+00:00

Using a local variable we can prevent gcc from reloading
aio_ring_file->f_inode->i_mapping twice, eliminating 2x2 dependent
loads.

Signed-off-by: Rasmus Villemoes 
Signed-off-by: Al Viro

aio: mark AIO pseudo-fs noexec

2016-09-15T22:49:28+00:00

This ensures that do_mmap() won't implicitly make AIO memory mappings
executable if the READ_IMPLIES_EXEC personality flag is set.  Such
behavior is problematic because the security_mmap_file LSM hook doesn't
catch this case, potentially permitting an attacker to bypass a W^X
policy enforced by SELinux.

I have tested the patch on my machine.

To test the behavior, compile and run this:

    #define _GNU_SOURCE
    #include 
    #include 
    #include 
    #include 
    #include 
    #include 
    #include 

    int main(void) {
        personality(READ_IMPLIES_EXEC);
        aio_context_t ctx = 0;
        if (syscall(__NR_io_setup, 1, &ctx))
            err(1, "io_setup");

        char cmd[1000];
        sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
            (int)getpid());
        system(cmd);
        return 0;
    }

In the output, "rw-s" is good, "rwxs" is bad.

Signed-off-by: Jann Horn 
Signed-off-by: Linus Torvalds

aio: make aio_setup_ring killable

2016-05-24T00:04:14+00:00

aio_setup_ring waits for mmap_sem in writable mode.  If the waiting task
gets killed by the oom killer it would block oom_reaper from
asynchronous address space reclaim and reduce the chances of timely OOM
resolving.  Wait for the lock in the killable mode and return with EINTR
if the task got killed while waiting.  This will also expedite the
return to the userspace and do_exit.

Signed-off-by: Michal Hocko 
Acked-by: Jeff Moyer 
Acked-by: Vlastimil Babka 
Cc: Benamin LaHaise 
Cc: Alexander Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

aio: remove a pointless assignment

2016-04-03T23:51:33+00:00

the value is never used after that point

Signed-off-by: Al Viro

mm: move ->mremap() from file_operations to vm_operations_struct

2015-09-04T23:54:41+00:00

vma->vm_ops->mremap() looks more natural and clean in move_vma(), and this
way ->mremap() can have more users.  Say, vdso.

While at it, s/aio_ring_remap/aio_ring_mremap/.

Note: this is the minimal change before ->mremap() finds another user in
file_operations; this method should have more arguments, and it can be
used to kill arch_remap().

Signed-off-by: Oleg Nesterov 
Acked-by: Pavel Emelyanov 
Acked-by: Kirill A. Shutemov 
Cc: David Rientjes 
Cc: Benjamin LaHaise 
Cc: Hugh Dickins 
Cc: Jeff Moyer 
Cc: Laurent Dufour 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds