aio: block exit_aio() until all context requests are completed

It seems that exit_aio() also needs to wait for all iocbs to complete (like
io_destroy), but we missed the wait step in current implemention, so fix
it in the same way as we did in io_destroy.

Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
Cc: stable@vger.kernel.org

1 files changed, 6 insertions, 1 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 5f2e9c6c328e..733750096b71 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -793,6 +793,8 @@ void exit_aio(struct mm_struct *mm)
 
         for (i = 0; i < table->nr; ++i) {
                 struct kioctx *ctx = table->table[i];
+                struct completion requests_done =
+                        COMPLETION_INITIALIZER_ONSTACK(requests_done);
 
                 if (!ctx)
                         continue;
@@ -804,7 +806,10 @@ void exit_aio(struct mm_struct *mm)
                  * that it needs to unmap the area, just set it to 0.
                  */
                 ctx->mmap_size = 0;
-                kill_ioctx(mm, ctx, NULL);
+                kill_ioctx(mm, ctx, &requests_done);
+
+                /* Wait until all IO for the context are done. */
+                wait_for_completion(&requests_done);
         }
 
         RCU_INIT_POINTER(mm->ioctx_table, NULL);