Messages in this thread | | | Subject | Re: 2.6.0-test6-mm4 - oops in __aio_run_iocbs() | From | Daniel McNeil <> | Date | 09 Oct 2003 10:42:25 -0700 |
| |
On Thu, 2003-10-09 at 05:59, Suparna Bhattacharya wrote: > On Thu, Oct 09, 2003 at 04:46:24PM +0530, Suparna Bhattacharya wrote: > > On Wed, Oct 08, 2003 at 04:18:15PM -0700, Daniel McNeil wrote: > > > I'm been testing AIO on test6-mm4 using a ext3 file system and > > > copying a 88MB file to an already existing preallocated file of 88MB. > > > I been using my aiocp program to copy the file using i/o sizes of > > > 1k to 512k and outstanding aio requests of between 1 and 64 using > > > O_DIRECT, O_SYNC and O_DIRECT & O_SYNC. Everything works as long > > > as the file is pre-allocated. When copying the file to a new file > > > (O_CREAT|O_DIRECT), I get the following oops: > > > > What are the i/o sizes and block sizes for which you get the oops ? > > Is this only for large i/o sizes ? > > > > __aio_run_iocbs should have been called only for buffered i/o, > > so this sounds like an O_DIRECT fallback to buffered i/o. > > Possibly after already submitting some blocks direct to BIO, > > the i/o completion path for which ends up calling aio_complete > > releasing the iocb. That could explain the use-after-free situation > > you see. > > > > But, O_DIRECT write should fallback to buffered i/o only if it > > encounters holes in the middle of the file, not for simple appends > > as in your case. Need to figure out how this could have happened ... > > Took a quick look at aiocp.c - wondering if its possible that > some of the later read requests complete earlier and trigger > a write to higher offset first. Resulting in the file being > extended with holes in between - holes which get overwritten > at a later point as the earlier read requests complete.
That is an interesting idea. I can change my aiocp program to do a printf if it hits this situation.
> > Though I don't yet see how a situation could arise in the > single threaded case where part of the request gets submitted > direct to BIO and the rest falls back to buffered-io ... Need > to think about it a bit more. > Are your writes all block aligned ?
All i/o is aligned to the size of the block size (128k in this test).
Daniel
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |