[XFS] Don't allow silent errors in xfs_inactive().

[deliverable/linux.git] / fs / aio.c

diff --git a/fs/aio.c b/fs/aio.c
index 26c1930889fafb0b191c202d2c5b7df4d8032ba8..228368610dfa64e7af06ec9dd864074cf550851e 100644 (file)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -936,14 +936,6 @@ int aio_complete(struct kiocb *iocb, long res, long res2)
                return 1;
        }
 
-       /*
-        * Check if the user asked us to deliver the result through an
-        * eventfd. The eventfd_signal() function is safe to be called
-        * from IRQ context.
-        */
-       if (!IS_ERR(iocb->ki_eventfd))
-               eventfd_signal(iocb->ki_eventfd, 1);
-
        info = &ctx->ring_info;
 
        /* add a completion event to the ring buffer.
@@ -992,10 +984,27 @@ int aio_complete(struct kiocb *iocb, long res, long res2)
        kunmap_atomic(ring, KM_IRQ1);
 
        pr_debug("added to ring %p at [%lu]\n", iocb, tail);
+
+       /*
+        * Check if the user asked us to deliver the result through an
+        * eventfd. The eventfd_signal() function is safe to be called
+        * from IRQ context.
+        */
+       if (!IS_ERR(iocb->ki_eventfd))
+               eventfd_signal(iocb->ki_eventfd, 1);
+
 put_rq:
        /* everything turned out well, dispose of the aiocb. */
        ret = __aio_put_req(ctx, iocb);
 
+       /*
+        * We have to order our ring_info tail store above and test
+        * of the wait list below outside the wait lock.  This is
+        * like in wake_up_bit() where clearing a bit has to be
+        * ordered with the unlocked test.
+        */
+       smp_mb();
+
        if (waitqueue_active(&ctx->wait))
                wake_up(&ctx->wait);
 
@@ -1329,6 +1338,10 @@ static ssize_t aio_rw_vect_retry(struct kiocb *iocb)
                opcode = IOCB_CMD_PWRITEV;
        }
 
+       /* This matches the pread()/pwrite() logic */
+       if (iocb->ki_pos < 0)
+               return -EINVAL;
+
        do {
                ret = rw_op(iocb, &iocb->ki_iovec[iocb->ki_cur_seg],
                            iocb->ki_nr_segs - iocb->ki_cur_seg,
@@ -1778,6 +1791,7 @@ asmlinkage long sys_io_getevents(aio_context_t ctx_id,
                put_ioctx(ioctx);
        }
 
+       asmlinkage_protect(5, ret, ctx_id, min_nr, nr, events, timeout);
        return ret;
 }