The patch titled Subject: fs/direct-io.c: fix possible use-after-free with AIO has been removed from the -mm tree. Its filename was fs-direct-ioc-fix-possible-use-after-free-with-aio.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Jan Kara <jack@xxxxxxx> Subject: fs/direct-io.c: fix possible use-after-free with AIO Running AIO is pinning inode in memory using file reference. Once AIO is completed using aio_complete(), file reference is put and inode can be freed from memory. So we have to be sure that calling aio_complete() is the last thing we do with the inode. Acked-by: Jeff Moyer <jmoyer@xxxxxxxxxx> Signed-off-by: Jan Kara <jack@xxxxxxx> Cc: Christoph Hellwig <hch@xxxxxxxxxxxxx> Cc: Jens Axboe <axboe@xxxxxxxxx> Cc: Jeff Moyer <jmoyer@xxxxxxxxxx> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/direct-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN fs/direct-io.c~fs-direct-ioc-fix-possible-use-after-free-with-aio fs/direct-io.c --- a/fs/direct-io.c~fs-direct-ioc-fix-possible-use-after-free-with-aio +++ a/fs/direct-io.c @@ -261,9 +261,9 @@ static ssize_t dio_complete(struct dio * dio->end_io(dio->iocb, offset, transferred, dio->private, ret, is_async); } else { + inode_dio_done(dio->inode); if (is_async) aio_complete(dio->iocb, ret, 0); - inode_dio_done(dio->inode); } return ret; _ Patches currently in -mm which might be from jack@xxxxxxx are origin.patch linux-next.patch fs-change-return-values-from-eacces-to-eperm.patch fs-return-eagain-when-o_nonblock-write-should-block-on-frozen-fs.patch fs-fix-hang-with-bsd-accounting-on-frozen-filesystem.patch ocfs2-add-freeze-protection-to-ocfs2_file_splice_write.patch hfsplus-add-osx-prefix-for-handling-namespace-of-mac-os-x-extended-attributes.patch hfsplus-add-on-disk-layout-declarations-related-to-attributes-tree.patch hfsplus-add-functionality-of-manipulating-by-records-in-attributes-tree.patch hfsplus-rework-functionality-of-getting-setting-and-deleting-of-extended-attributes.patch hfsplus-add-support-of-manipulation-by-attributes-file.patch hfsplus-fix-issue-with-unzeroed-unused-b-tree-nodes.patch ocfs2-fix-possible-use-after-free-with-aio.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html