3 files changed, 26 insertions, 14 deletions

diff --git a/fs/aio.c b/fs/aio.c
index edfca5b75535..20bb919eb195 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -42,8 +42,9 @@
 #endif
 
 /*------ sysctl variables----*/
-atomic_t aio_nr = ATOMIC_INIT(0);       /* current system wide number of aio requests */
-unsigned aio_max_nr = 0x10000;  /* system wide maximum number of aio requests */
+static DEFINE_SPINLOCK(aio_nr_lock);
+unsigned long aio_nr;           /* current system wide number of aio requests */
+unsigned long aio_max_nr = 0x10000; /* system wide maximum number of aio requests */
 /*----end sysctl variables---*/
 
 static kmem_cache_t     *kiocb_cachep;
@@ -208,7 +209,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
                 return ERR_PTR(-EINVAL);
         }
 
-        if (nr_events > aio_max_nr)
+        if ((unsigned long)nr_events > aio_max_nr)
                 return ERR_PTR(-EAGAIN);
 
         ctx = kmem_cache_alloc(kioctx_cachep, GFP_KERNEL);
@@ -233,8 +234,14 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
                 goto out_freectx;
 
         /* limit the number of system wide aios */
-        atomic_add(ctx->max_reqs, &aio_nr);     /* undone by __put_ioctx */
-        if (unlikely(atomic_read(&aio_nr) > aio_max_nr))
+        spin_lock(&aio_nr_lock);
+        if (aio_nr + ctx->max_reqs > aio_max_nr ||
+            aio_nr + ctx->max_reqs < aio_nr)
+                ctx->max_reqs = 0;
+        else
+                aio_nr += ctx->max_reqs;
+        spin_unlock(&aio_nr_lock);
+        if (ctx->max_reqs == 0)
                 goto out_cleanup;
 
         /* now link into global list.  kludge.  FIXME */
@@ -248,8 +255,6 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         return ctx;
 
 out_cleanup:
-        atomic_sub(ctx->max_reqs, &aio_nr);
-        ctx->max_reqs = 0;      /* prevent __put_ioctx from sub'ing aio_nr */
         __put_ioctx(ctx);
         return ERR_PTR(-EAGAIN);
 
@@ -374,7 +379,12 @@ void fastcall __put_ioctx(struct kioctx *ctx)
         pr_debug("__put_ioctx: freeing %p\n", ctx);
         kmem_cache_free(kioctx_cachep, ctx);
 
-        atomic_sub(nr_events, &aio_nr);
+        if (nr_events) {
+                spin_lock(&aio_nr_lock);
+                BUG_ON(aio_nr - nr_events > aio_nr);
+                aio_nr -= nr_events;
+                spin_unlock(&aio_nr_lock);
+        }
 }
 
 /* aio_get_req
@@ -1258,8 +1268,9 @@ asmlinkage long sys_io_setup(unsigned nr_events, aio_context_t __user *ctxp)
                 goto out;
 
         ret = -EINVAL;
-        if (unlikely(ctx || (int)nr_events <= 0)) {
-                pr_debug("EINVAL: io_setup: ctx or nr_events > max\n");
+        if (unlikely(ctx || nr_events == 0)) {
+                pr_debug("EINVAL: io_setup: ctx %lu nr_events %u\n",
+                         ctx, nr_events);
                 goto out;
         }
 
diff --git a/include/linux/aio.h b/include/linux/aio.h
index 0decf66117c1..403d71dcb7c8 100644
--- a/include/linux/aio.h
+++ b/include/linux/aio.h
@@ -183,6 +183,7 @@ struct kioctx {
         struct list_head        active_reqs;    /* used for cancellation */
         struct list_head        run_list;       /* used for kicked reqs */
 
+        /* sys_io_setup currently limits this to an unsigned int */
         unsigned                max_reqs;
 
         struct aio_ring_info    ring_info;
@@ -234,7 +235,7 @@ static inline struct kiocb *list_kiocb(struct list_head *h)
 }
 
 /* for sysctl: */
-extern atomic_t aio_nr;
-extern unsigned aio_max_nr;
+extern unsigned long aio_nr;
+extern unsigned long aio_max_nr;
 
 #endif /* __LINUX__AIO_H */
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 8e56e2495542..e1351200ce85 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -952,7 +952,7 @@ static ctl_table fs_table[] = {
                 .data           = &aio_nr,
                 .maxlen         = sizeof(aio_nr),
                 .mode           = 0444,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = &proc_doulongvec_minmax,
         },
         {
                 .ctl_name       = FS_AIO_MAX_NR,
@@ -960,7 +960,7 @@ static ctl_table fs_table[] = {
                 .data           = &aio_max_nr,
                 .maxlen         = sizeof(aio_max_nr),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = &proc_doulongvec_minmax,
         },
 #ifdef CONFIG_INOTIFY
         {