Patched in Tegra support.

1 files changed, 186 insertions, 181 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 71f613cf4a8..e29ec485af2 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -13,7 +13,7 @@
 #include <linux/errno.h>
 #include <linux/time.h>
 #include <linux/aio_abi.h>
-#include <linux/export.h>
+#include <linux/module.h>
 #include <linux/syscalls.h>
 #include <linux/backing-dev.h>
 #include <linux/uio.h>
@@ -56,6 +56,13 @@ static struct kmem_cache	*kioctx_cachep;
 
 static struct workqueue_struct *aio_wq;
 
+/* Used for rare fput completion. */
+static void aio_fput_routine(struct work_struct *);
+static DECLARE_WORK(fput_work, aio_fput_routine);
+
+static DEFINE_SPINLOCK(fput_lock);
+static LIST_HEAD(fput_head);
+
 static void aio_kick_handler(struct work_struct *);
 static void aio_queue_work(struct kioctx *);
 
@@ -86,8 +93,9 @@ static void aio_free_ring(struct kioctx *ctx)
                 put_page(info->ring_pages[i]);
 
         if (info->mmap_size) {
-                BUG_ON(ctx->mm != current->mm);
-                vm_munmap(info->mmap_base, info->mmap_size);
+                down_write(&ctx->mm->mmap_sem);
+                do_munmap(ctx->mm, info->mmap_base, info->mmap_size);
+                up_write(&ctx->mm->mmap_sem);
         }
 
         if (info->ring_pages && info->ring_pages != info->internal_pages)
@@ -127,9 +135,9 @@ static int aio_setup_ring(struct kioctx *ctx)
         info->mmap_size = nr_pages * PAGE_SIZE;
         dprintk("attempting mmap of %lu bytes\n", info->mmap_size);
         down_write(&ctx->mm->mmap_sem);
-        info->mmap_base = do_mmap_pgoff(NULL, 0, info->mmap_size, 
-                                        PROT_READ|PROT_WRITE,
-                                        MAP_ANONYMOUS|MAP_PRIVATE, 0);
+        info->mmap_base = do_mmap(NULL, 0, info->mmap_size, 
+                                  PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE,
+                                  0);
         if (IS_ERR((void *)info->mmap_base)) {
                 up_write(&ctx->mm->mmap_sem);
                 info->mmap_size = 0;
@@ -152,7 +160,7 @@ static int aio_setup_ring(struct kioctx *ctx)
 
         info->nr = nr_events;           /* trusted copy */
 
-        ring = kmap_atomic(info->ring_pages[0]);
+        ring = kmap_atomic(info->ring_pages[0], KM_USER0);
         ring->nr = nr_events;   /* user copy */
         ring->id = ctx->user_id;
         ring->head = ring->tail = 0;
@@ -160,38 +168,47 @@ static int aio_setup_ring(struct kioctx *ctx)
         ring->compat_features = AIO_RING_COMPAT_FEATURES;
         ring->incompat_features = AIO_RING_INCOMPAT_FEATURES;
         ring->header_length = sizeof(struct aio_ring);
-        kunmap_atomic(ring);
+        kunmap_atomic(ring, KM_USER0);
 
         return 0;
 }
 
 
 /* aio_ring_event: returns a pointer to the event at the given index from
- * kmap_atomic().  Release the pointer with put_aio_ring_event();
+ * kmap_atomic(, km).  Release the pointer with put_aio_ring_event();
  */
 #define AIO_EVENTS_PER_PAGE     (PAGE_SIZE / sizeof(struct io_event))
 #define AIO_EVENTS_FIRST_PAGE   ((PAGE_SIZE - sizeof(struct aio_ring)) / sizeof(struct io_event))
 #define AIO_EVENTS_OFFSET       (AIO_EVENTS_PER_PAGE - AIO_EVENTS_FIRST_PAGE)
 
-#define aio_ring_event(info, nr) ({                                     \
+#define aio_ring_event(info, nr, km) ({                                 \
         unsigned pos = (nr) + AIO_EVENTS_OFFSET;                        \
         struct io_event *__event;                                       \
         __event = kmap_atomic(                                          \
-                        (info)->ring_pages[pos / AIO_EVENTS_PER_PAGE]); \
+                        (info)->ring_pages[pos / AIO_EVENTS_PER_PAGE], km); \
         __event += pos % AIO_EVENTS_PER_PAGE;                           \
         __event;                                                        \
 })
 
-#define put_aio_ring_event(event) do {          \
+#define put_aio_ring_event(event, km) do {      \
         struct io_event *__event = (event);     \
         (void)__event;                          \
-        kunmap_atomic((void *)((unsigned long)__event & PAGE_MASK)); \
+        kunmap_atomic((void *)((unsigned long)__event & PAGE_MASK), km); \
 } while(0)
 
 static void ctx_rcu_free(struct rcu_head *head)
 {
         struct kioctx *ctx = container_of(head, struct kioctx, rcu_head);
+        unsigned nr_events = ctx->max_reqs;
+
         kmem_cache_free(kioctx_cachep, ctx);
+
+        if (nr_events) {
+                spin_lock(&aio_nr_lock);
+                BUG_ON(aio_nr - nr_events > aio_nr);
+                aio_nr -= nr_events;
+                spin_unlock(&aio_nr_lock);
+        }
 }
 
 /* __put_ioctx
@@ -200,23 +217,23 @@ static void ctx_rcu_free(struct rcu_head *head)
  */
 static void __put_ioctx(struct kioctx *ctx)
 {
-        unsigned nr_events = ctx->max_reqs;
         BUG_ON(ctx->reqs_active);
 
-        cancel_delayed_work_sync(&ctx->wq);
+        cancel_delayed_work(&ctx->wq);
+        cancel_work_sync(&ctx->wq.work);
         aio_free_ring(ctx);
         mmdrop(ctx->mm);
         ctx->mm = NULL;
-        if (nr_events) {
-                spin_lock(&aio_nr_lock);
-                BUG_ON(aio_nr - nr_events > aio_nr);
-                aio_nr -= nr_events;
-                spin_unlock(&aio_nr_lock);
-        }
         pr_debug("__put_ioctx: freeing %p\n", ctx);
         call_rcu(&ctx->rcu_head, ctx_rcu_free);
 }
 
+static inline void get_ioctx(struct kioctx *kioctx)
+{
+        BUG_ON(atomic_read(&kioctx->users) <= 0);
+        atomic_inc(&kioctx->users);
+}
+
 static inline int try_get_ioctx(struct kioctx *kioctx)
 {
         return atomic_inc_not_zero(&kioctx->users);
@@ -236,7 +253,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
 {
         struct mm_struct *mm;
         struct kioctx *ctx;
-        int err = -ENOMEM;
+        int did_sync = 0;
 
         /* Prevent overflows */
         if ((nr_events > (0x10000000U / sizeof(struct io_event))) ||
@@ -245,7 +262,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
                 return ERR_PTR(-EINVAL);
         }
 
-        if (!nr_events || (unsigned long)nr_events > aio_max_nr)
+        if ((unsigned long)nr_events > aio_max_nr)
                 return ERR_PTR(-EAGAIN);
 
         ctx = kmem_cache_zalloc(kioctx_cachep, GFP_KERNEL);
@@ -256,7 +273,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         mm = ctx->mm = current->mm;
         atomic_inc(&mm->mm_count);
 
-        atomic_set(&ctx->users, 2);
+        atomic_set(&ctx->users, 1);
         spin_lock_init(&ctx->ctx_lock);
         spin_lock_init(&ctx->ring_info.ring_lock);
         init_waitqueue_head(&ctx->wait);
@@ -269,14 +286,25 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
                 goto out_freectx;
 
         /* limit the number of system wide aios */
-        spin_lock(&aio_nr_lock);
-        if (aio_nr + nr_events > aio_max_nr ||
-            aio_nr + nr_events < aio_nr) {
-                spin_unlock(&aio_nr_lock);
+        do {
+                spin_lock_bh(&aio_nr_lock);
+                if (aio_nr + nr_events > aio_max_nr ||
+                    aio_nr + nr_events < aio_nr)
+                        ctx->max_reqs = 0;
+                else
+                        aio_nr += ctx->max_reqs;
+                spin_unlock_bh(&aio_nr_lock);
+                if (ctx->max_reqs || did_sync)
+                        break;
+
+                /* wait for rcu callbacks to have completed before giving up */
+                synchronize_rcu();
+                did_sync = 1;
+                ctx->max_reqs = nr_events;
+        } while (1);
+
+        if (ctx->max_reqs == 0)
                 goto out_cleanup;
-        }
-        aio_nr += ctx->max_reqs;
-        spin_unlock(&aio_nr_lock);
 
         /* now link into global list. */
         spin_lock(&mm->ioctx_lock);
@@ -288,27 +316,27 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         return ctx;
 
 out_cleanup:
-        err = -EAGAIN;
-        aio_free_ring(ctx);
+        __put_ioctx(ctx);
+        return ERR_PTR(-EAGAIN);
+
 out_freectx:
         mmdrop(mm);
         kmem_cache_free(kioctx_cachep, ctx);
-        dprintk("aio: error allocating ioctx %d\n", err);
-        return ERR_PTR(err);
+        ctx = ERR_PTR(-ENOMEM);
+
+        dprintk("aio: error allocating ioctx %p\n", ctx);
+        return ctx;
 }
 
-/* kill_ctx
+/* aio_cancel_all
  *      Cancels all outstanding aio requests on an aio context.  Used 
  *      when the processes owning a context have all exited to encourage 
  *      the rapid destruction of the kioctx.
  */
-static void kill_ctx(struct kioctx *ctx)
+static void aio_cancel_all(struct kioctx *ctx)
 {
         int (*cancel)(struct kiocb *, struct io_event *);
-        struct task_struct *tsk = current;
-        DECLARE_WAITQUEUE(wait, tsk);
         struct io_event res;
-
         spin_lock_irq(&ctx->ctx_lock);
         ctx->dead = 1;
         while (!list_empty(&ctx->active_reqs)) {
@@ -324,7 +352,15 @@ static void kill_ctx(struct kioctx *ctx)
                         spin_lock_irq(&ctx->ctx_lock);
                 }
         }
+        spin_unlock_irq(&ctx->ctx_lock);
+}
+
+static void wait_for_all_aios(struct kioctx *ctx)
+{
+        struct task_struct *tsk = current;
+        DECLARE_WAITQUEUE(wait, tsk);
 
+        spin_lock_irq(&ctx->ctx_lock);
         if (!ctx->reqs_active)
                 goto out;
 
@@ -374,24 +410,19 @@ void exit_aio(struct mm_struct *mm)
                 ctx = hlist_entry(mm->ioctx_list.first, struct kioctx, list);
                 hlist_del_rcu(&ctx->list);
 
-                kill_ctx(ctx);
+                aio_cancel_all(ctx);
+
+                wait_for_all_aios(ctx);
+                /*
+                 * Ensure we don't leave the ctx on the aio_wq
+                 */
+                cancel_work_sync(&ctx->wq.work);
 
                 if (1 != atomic_read(&ctx->users))
                         printk(KERN_DEBUG
                                 "exit_aio:ioctx still alive: %d %d %d\n",
                                 atomic_read(&ctx->users), ctx->dead,
                                 ctx->reqs_active);
-                /*
-                 * We don't need to bother with munmap() here -
-                 * exit_mmap(mm) is coming and it'll unmap everything.
-                 * Since aio_free_ring() uses non-zero ->mmap_size
-                 * as indicator that it needs to unmap the area,
-                 * just set it to 0; aio_free_ring() is the only
-                 * place that uses ->mmap_size, so it's safe.
-                 * That way we get all munmap done to current->mm -
-                 * all other callers have ctx->mm == current->mm.
-                 */
-                ctx->ring_info.mmap_size = 0;
                 put_ioctx(ctx);
         }
 }
@@ -409,6 +440,8 @@ void exit_aio(struct mm_struct *mm)
 static struct kiocb *__aio_get_req(struct kioctx *ctx)
 {
         struct kiocb *req = NULL;
+        struct aio_ring *ring;
+        int okay = 0;
 
         req = kmem_cache_alloc(kiocb_cachep, GFP_KERNEL);
         if (unlikely(!req))
@@ -426,105 +459,39 @@ static struct kiocb *__aio_get_req(struct kioctx *ctx)
         INIT_LIST_HEAD(&req->ki_run_list);
         req->ki_eventfd = NULL;
 
-        return req;
-}
-
-/*
- * struct kiocb's are allocated in batches to reduce the number of
- * times the ctx lock is acquired and released.
- */
-#define KIOCB_BATCH_SIZE        32L
-struct kiocb_batch {
-        struct list_head head;
-        long count; /* number of requests left to allocate */
-};
-
-static void kiocb_batch_init(struct kiocb_batch *batch, long total)
-{
-        INIT_LIST_HEAD(&batch->head);
-        batch->count = total;
-}
-
-static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
-{
-        struct kiocb *req, *n;
-
-        if (list_empty(&batch->head))
-                return;
-
-        spin_lock_irq(&ctx->ctx_lock);
-        list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
-                list_del(&req->ki_batch);
-                list_del(&req->ki_list);
-                kmem_cache_free(kiocb_cachep, req);
-                ctx->reqs_active--;
-        }
-        if (unlikely(!ctx->reqs_active && ctx->dead))
-                wake_up_all(&ctx->wait);
-        spin_unlock_irq(&ctx->ctx_lock);
-}
-
-/*
- * Allocate a batch of kiocbs.  This avoids taking and dropping the
- * context lock a lot during setup.
- */
-static int kiocb_batch_refill(struct kioctx *ctx, struct kiocb_batch *batch)
-{
-        unsigned short allocated, to_alloc;
-        long avail;
-        struct kiocb *req, *n;
-        struct aio_ring *ring;
-
-        to_alloc = min(batch->count, KIOCB_BATCH_SIZE);
-        for (allocated = 0; allocated < to_alloc; allocated++) {
-                req = __aio_get_req(ctx);
-                if (!req)
-                        /* allocation failed, go with what we've got */
-                        break;
-                list_add(&req->ki_batch, &batch->head);
-        }
-
-        if (allocated == 0)
-                goto out;
-
+        /* Check if the completion queue has enough free space to
+         * accept an event from this io.
+         */
         spin_lock_irq(&ctx->ctx_lock);
-        ring = kmap_atomic(ctx->ring_info.ring_pages[0]);
-
-        avail = aio_ring_avail(&ctx->ring_info, ring) - ctx->reqs_active;
-        BUG_ON(avail < 0);
-        if (avail < allocated) {
-                /* Trim back the number of requests. */
-                list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
-                        list_del(&req->ki_batch);
-                        kmem_cache_free(kiocb_cachep, req);
-                        if (--allocated <= avail)
-                                break;
-                }
-        }
-
-        batch->count -= allocated;
-        list_for_each_entry(req, &batch->head, ki_batch) {
+        ring = kmap_atomic(ctx->ring_info.ring_pages[0], KM_USER0);
+        if (ctx->reqs_active < aio_ring_avail(&ctx->ring_info, ring)) {
                 list_add(&req->ki_list, &ctx->active_reqs);
                 ctx->reqs_active++;
+                okay = 1;
         }
-
-        kunmap_atomic(ring);
+        kunmap_atomic(ring, KM_USER0);
         spin_unlock_irq(&ctx->ctx_lock);
 
-out:
-        return allocated;
+        if (!okay) {
+                kmem_cache_free(kiocb_cachep, req);
+                req = NULL;
+        }
+
+        return req;
 }
 
-static inline struct kiocb *aio_get_req(struct kioctx *ctx,
-                                        struct kiocb_batch *batch)
+static inline struct kiocb *aio_get_req(struct kioctx *ctx)
 {
         struct kiocb *req;
-
-        if (list_empty(&batch->head))
-                if (kiocb_batch_refill(ctx, batch) == 0)
-                        return NULL;
-        req = list_first_entry(&batch->head, struct kiocb, ki_batch);
-        list_del(&req->ki_batch);
+        /* Handle a potential starvation case -- should be exceedingly rare as 
+         * requests will be stuck on fput_head only if the aio_fput_routine is 
+         * delayed and the requests were the last user of the struct file.
+         */
+        req = __aio_get_req(ctx);
+        if (unlikely(NULL == req)) {
+                aio_fput_routine(NULL);
+                req = __aio_get_req(ctx);
+        }
         return req;
 }
 
@@ -545,6 +512,31 @@ static inline void really_put_req(struct kioctx *ctx, struct kiocb *req)
                 wake_up_all(&ctx->wait);
 }
 
+static void aio_fput_routine(struct work_struct *data)
+{
+        spin_lock_irq(&fput_lock);
+        while (likely(!list_empty(&fput_head))) {
+                struct kiocb *req = list_kiocb(fput_head.next);
+                struct kioctx *ctx = req->ki_ctx;
+
+                list_del(&req->ki_list);
+                spin_unlock_irq(&fput_lock);
+
+                /* Complete the fput(s) */
+                if (req->ki_filp != NULL)
+                        fput(req->ki_filp);
+
+                /* Link the iocb into the context's free list */
+                spin_lock_irq(&ctx->ctx_lock);
+                really_put_req(ctx, req);
+                spin_unlock_irq(&ctx->ctx_lock);
+
+                put_ioctx(ctx);
+                spin_lock_irq(&fput_lock);
+        }
+        spin_unlock_irq(&fput_lock);
+}
+
 /* __aio_put_req
  *      Returns true if this put was the last user of the request.
  */
@@ -563,9 +555,22 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
         req->ki_cancel = NULL;
         req->ki_retry = NULL;
 
-        fput(req->ki_filp);
-        req->ki_filp = NULL;
-        really_put_req(ctx, req);
+        /*
+         * Try to optimize the aio and eventfd file* puts, by avoiding to
+         * schedule work in case it is not final fput() time. In normal cases,
+         * we would not be holding the last reference to the file*, so
+         * this function will be executed w/out any aio kthread wakeup.
+         */
+        if (unlikely(!fput_atomic(req->ki_filp))) {
+                get_ioctx(ctx);
+                spin_lock(&fput_lock);
+                list_add(&req->ki_list, &fput_head);
+                spin_unlock(&fput_lock);
+                schedule_work(&fput_work);
+        } else {
+                req->ki_filp = NULL;
+                really_put_req(ctx, req);
+        }
         return 1;
 }
 
@@ -835,7 +840,7 @@ static void aio_kick_handler(struct work_struct *work)
         unuse_mm(mm);
         set_fs(oldfs);
         /*
-         * we're in a worker thread already; no point using non-zero delay
+         * we're in a worker thread already, don't use queue_delayed_work,
          */
         if (requeue)
                 queue_delayed_work(aio_wq, &ctx->wq, 0);
@@ -934,10 +939,10 @@ int aio_complete(struct kiocb *iocb, long res, long res2)
         if (kiocbIsCancelled(iocb))
                 goto put_rq;
 
-        ring = kmap_atomic(info->ring_pages[0]);
+        ring = kmap_atomic(info->ring_pages[0], KM_IRQ1);
 
         tail = info->tail;
-        event = aio_ring_event(info, tail);
+        event = aio_ring_event(info, tail, KM_IRQ0);
         if (++tail >= info->nr)
                 tail = 0;
 
@@ -958,8 +963,8 @@ int aio_complete(struct kiocb *iocb, long res, long res2)
         info->tail = tail;
         ring->tail = tail;
 
-        put_aio_ring_event(event);
-        kunmap_atomic(ring);
+        put_aio_ring_event(event, KM_IRQ0);
+        kunmap_atomic(ring, KM_IRQ1);
 
         pr_debug("added to ring %p at [%lu]\n", iocb, tail);
 
@@ -1004,7 +1009,7 @@ static int aio_read_evt(struct kioctx *ioctx, struct io_event *ent)
         unsigned long head;
         int ret = 0;
 
-        ring = kmap_atomic(info->ring_pages[0]);
+        ring = kmap_atomic(info->ring_pages[0], KM_USER0);
         dprintk("in aio_read_evt h%lu t%lu m%lu\n",
                  (unsigned long)ring->head, (unsigned long)ring->tail,
                  (unsigned long)ring->nr);
@@ -1016,18 +1021,18 @@ static int aio_read_evt(struct kioctx *ioctx, struct io_event *ent)
 
         head = ring->head % info->nr;
         if (head != ring->tail) {
-                struct io_event *evp = aio_ring_event(info, head);
+                struct io_event *evp = aio_ring_event(info, head, KM_USER1);
                 *ent = *evp;
                 head = (head + 1) % info->nr;
                 smp_mb(); /* finish reading the event before updatng the head */
                 ring->head = head;
                 ret = 1;
-                put_aio_ring_event(evp);
+                put_aio_ring_event(evp, KM_USER1);
         }
         spin_unlock(&info->ring_lock);
 
 out:
-        kunmap_atomic(ring);
+        kunmap_atomic(ring, KM_USER0);
         dprintk("leaving aio_read_evt: %d  h%lu t%lu\n", ret,
                  (unsigned long)ring->head, (unsigned long)ring->tail);
         return ret;
@@ -1205,7 +1210,8 @@ static void io_destroy(struct kioctx *ioctx)
         if (likely(!was_dead))
                 put_ioctx(ioctx);       /* twice for the list */
 
-        kill_ctx(ioctx);
+        aio_cancel_all(ioctx);
+        wait_for_all_aios(ioctx);
 
         /*
          * Wake up any waiters.  The setting of ctx->dead must be seen
@@ -1213,6 +1219,7 @@ static void io_destroy(struct kioctx *ioctx)
          * locking done by the above calls to ensure this consistency.
          */
         wake_up_all(&ioctx->wait);
+        put_ioctx(ioctx);       /* once for the lookup */
 }
 
 /* sys_io_setup:
@@ -1249,9 +1256,11 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
         ret = PTR_ERR(ioctx);
         if (!IS_ERR(ioctx)) {
                 ret = put_user(ioctx->user_id, ctxp);
-                if (ret)
-                        io_destroy(ioctx);
-                put_ioctx(ioctx);
+                if (!ret)
+                        return 0;
+
+                get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */
+                io_destroy(ioctx);
         }
 
 out:
@@ -1269,7 +1278,6 @@ SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
         struct kioctx *ioctx = lookup_ioctx(ctx);
         if (likely(NULL != ioctx)) {
                 io_destroy(ioctx);
-                put_ioctx(ioctx);
                 return 0;
         }
         pr_debug("EINVAL: io_destroy: invalid context id\n");
@@ -1389,10 +1397,6 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
         if (ret < 0)
                 goto out;
 
-        ret = rw_verify_area(type, kiocb->ki_filp, &kiocb->ki_pos, ret);
-        if (ret < 0)
-                goto out;
-
         kiocb->ki_nr_segs = kiocb->ki_nbytes;
         kiocb->ki_cur_seg = 0;
         /* ki_nbytes/left now reflect bytes instead of segs */
@@ -1404,17 +1408,11 @@ out:
         return ret;
 }
 
-static ssize_t aio_setup_single_vector(int type, struct file * file, struct kiocb *kiocb)
+static ssize_t aio_setup_single_vector(struct kiocb *kiocb)
 {
-        int bytes;
-
-        bytes = rw_verify_area(type, file, &kiocb->ki_pos, kiocb->ki_left);
-        if (bytes < 0)
-                return bytes;
-
         kiocb->ki_iovec = &kiocb->ki_inline_vec;
         kiocb->ki_iovec->iov_base = kiocb->ki_buf;
-        kiocb->ki_iovec->iov_len = bytes;
+        kiocb->ki_iovec->iov_len = kiocb->ki_left;
         kiocb->ki_nr_segs = 1;
         kiocb->ki_cur_seg = 0;
         return 0;
@@ -1439,7 +1437,10 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
-                ret = aio_setup_single_vector(READ, file, kiocb);
+                ret = security_file_permission(file, MAY_READ);
+                if (unlikely(ret))
+                        break;
+                ret = aio_setup_single_vector(kiocb);
                 if (ret)
                         break;
                 ret = -EINVAL;
@@ -1454,7 +1455,10 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
-                ret = aio_setup_single_vector(WRITE, file, kiocb);
+                ret = security_file_permission(file, MAY_WRITE);
+                if (unlikely(ret))
+                        break;
+                ret = aio_setup_single_vector(kiocb);
                 if (ret)
                         break;
                 ret = -EINVAL;
@@ -1465,6 +1469,9 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 ret = -EBADF;
                 if (unlikely(!(file->f_mode & FMODE_READ)))
                         break;
+                ret = security_file_permission(file, MAY_READ);
+                if (unlikely(ret))
+                        break;
                 ret = aio_setup_vectored_rw(READ, kiocb, compat);
                 if (ret)
                         break;
@@ -1476,6 +1483,9 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 ret = -EBADF;
                 if (unlikely(!(file->f_mode & FMODE_WRITE)))
                         break;
+                ret = security_file_permission(file, MAY_WRITE);
+                if (unlikely(ret))
+                        break;
                 ret = aio_setup_vectored_rw(WRITE, kiocb, compat);
                 if (ret)
                         break;
@@ -1505,8 +1515,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
 }
 
 static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
-                         struct iocb *iocb, struct kiocb_batch *batch,
-                         bool compat)
+                         struct iocb *iocb, bool compat)
 {
         struct kiocb *req;
         struct file *file;
@@ -1532,7 +1541,7 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
         if (unlikely(!file))
                 return -EBADF;
 
-        req = aio_get_req(ctx, batch);  /* returns with 2 references to req */
+        req = aio_get_req(ctx);         /* returns with 2 references to req */
         if (unlikely(!req)) {
                 fput(file);
                 return -EAGAIN;
@@ -1612,9 +1621,8 @@ long do_io_submit(aio_context_t ctx_id, long nr,
 {
         struct kioctx *ctx;
         long ret = 0;
-        int i = 0;
+        int i;
         struct blk_plug plug;
-        struct kiocb_batch batch;
 
         if (unlikely(nr < 0))
                 return -EINVAL;
@@ -1631,8 +1639,6 @@ long do_io_submit(aio_context_t ctx_id, long nr,
                 return -EINVAL;
         }
 
-        kiocb_batch_init(&batch, nr);
-
         blk_start_plug(&plug);
 
         /*
@@ -1653,13 +1659,12 @@ long do_io_submit(aio_context_t ctx_id, long nr,
                         break;
                 }
 
-                ret = io_submit_one(ctx, user_iocb, &tmp, &batch, compat);
+                ret = io_submit_one(ctx, user_iocb, &tmp, compat);
                 if (ret)
                         break;
         }
         blk_finish_plug(&plug);
 
-        kiocb_batch_free(ctx, &batch);
         put_ioctx(ctx);
         return i ? i : ret;
 }