lkml.org 
[lkml]   [2004]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] Oops in aio_free_ring on 2.6.9
On Sat, Nov 06, 2004 at 07:43:33PM -0800, Linus Torvalds wrote:
>
> On Fri, 5 Nov 2004, Darrick J. Wong wrote:
> >
> > Next, the aio_setup_ring function tries to mmap a bunch of pages and
> > fails, because in step 1 we used up all the address space.
> > aio_setup_ring then calls aio_free_ring to tear all of this down.
> > (fs/aio.c:143)
> >
> > aio_free_ring sees the block of struct page pointers and calls free_page
> > (fs/aio.c:88) on the pointers without checking that they're not NULL.
> > Unfortunately, they _are_ NULL and *oops*! My patch amends the function
> > to include a null pointer check.
>
> I don't disagree with the bug, but I disagree with the fix.
>
> In my opinion, the problem is that "info->nr_pages" is _wrong_. It's wrong
> because it has been initialized to a bogus value.
>
> I'd much prefer this alternate appended patch. Can you verify that it also
> fixes the problem (we can drop the bogus info->nr_pages initialization,
> because the context - including the info part - has been cleared when it
> was allocated, so nr_pages should already have the _correct_ value of zero
> at this point).

Since aio_free_ring uses comparison with info->internal_pages rather than
nr_pages to decide whether to kfree(info->ring_pages), I see your point.

Regards
Suparna

>
> Linus
>
> -----
> ===== fs/aio.c 1.60 vs edited =====
> --- 1.60/fs/aio.c 2004-10-20 01:12:10 -07:00
> +++ edited/fs/aio.c 2004-11-06 19:41:45 -08:00
> @@ -118,8 +118,6 @@
> if (nr_pages < 0)
> return -EINVAL;
>
> - info->nr_pages = nr_pages;
> -
> nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
>
> info->nr = 0;
> --
> To unsubscribe, send a message with 'unsubscribe linux-aio' in
> the body to majordomo@kvack.org. For more info on Linux AIO,
> see: http://www.kvack.org/aio/
> Don't email: <a href=mailto:"aart@kvack.org">aart@kvack.org</a>

--
Suparna Bhattacharya (suparna@in.ibm.com)
Linux Technology Center
IBM Software Lab, India

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:07    [W:0.059 / U:0.884 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site