1 files changed, 6 insertions, 0 deletions

diff --git a/fs/aio.c b/fs/aio.c
index f4a27af6c9ac..6b868f0e0c4c 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -479,6 +479,7 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
         struct aio_ring *ring;
 
         spin_lock(&mm->ioctx_lock);
+        rcu_read_lock();
         table = rcu_dereference(mm->ioctx_table);
 
         while (1) {
@@ -487,6 +488,7 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
                                 if (!table->table[i]) {
                                         ctx->id = i;
                                         table->table[i] = ctx;
+                                        rcu_read_unlock();
                                         spin_unlock(&mm->ioctx_lock);
 
                                         ring = kmap_atomic(ctx->ring_pages[0]);
@@ -497,6 +499,7 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
 
                 new_nr = (table ? table->nr : 1) * 4;
 
+                rcu_read_unlock();
                 spin_unlock(&mm->ioctx_lock);
 
                 table = kzalloc(sizeof(*table) + sizeof(struct kioctx *) *
@@ -507,6 +510,7 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
                 table->nr = new_nr;
 
                 spin_lock(&mm->ioctx_lock);
+                rcu_read_lock();
                 old = rcu_dereference(mm->ioctx_table);
 
                 if (!old) {
@@ -631,10 +635,12 @@ static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx)
                 struct kioctx_table *table;
 
                 spin_lock(&mm->ioctx_lock);
+                rcu_read_lock();
                 table = rcu_dereference(mm->ioctx_table);
 
                 WARN_ON(ctx != table->table[ctx->id]);
                 table->table[ctx->id] = NULL;
+                rcu_read_unlock();
                 spin_unlock(&mm->ioctx_lock);
 
                 /* percpu_ref_kill() will do the necessary call_rcu() */