Messages in this thread | | | From | Badari Pulavarty <> | Subject | Re: AIO Oops on 2.6.3-mm3 | Date | Tue, 2 Mar 2004 11:09:03 -0800 |
| |
On Tuesday 02 March 2004 10:57 am, Daniel McNeil wrote: > I fixed reference counting when the i/o completed before the > submit path was done referencing the iocb. This looks > similar except it is getting a fault.
I wonder whats different here. Even in this case, IO did complete with EFAULT.
Just for argument, if the IO completed correctly (without errors) - how would it not run into this ? io_submit_one() will call aio_complete() is the return code is NOT -EIOCBQUEUED. Isn't it ? How do we prevent calling aio_complete() twice ?
Thanks, Badari
> > I found the problem.. But no fix yet !! > > > > Here is whats happening.. > > > > io_submit_one() : > > > > gets iocb with 2 refs > > calls file->f_op->aio_write() which returns EFAULT... > > This calls aio_complete() with EFAULT. aio_complete() drops a ref. > > calls aio_put_req() which drops a ref - since the count is > > zero it frees iocb. > > Since we got EFAULT, io_submit_one() calls aio_complete() > > with freed up iocb - so we get OOPS. > > > > The problem here is we are calling aio_complete() twice. > > > > Daneil, didn't you fix this earlier ? > > > > int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb, > > { > > > > ... > > req = aio_get_req(ctx); /* returns with 2 references to req */ > > .. > > case IOCB_CMD_PWRITE: > > ... > > ret = file->f_op->aio_write(req, buf, > > iocb->aio_nbytes, req->ki_pos); > > ... > > aio_put_req(req); /* drop extra ref to req */ > > if (likely(-EIOCBQUEUED == ret)) > > return 0; > > aio_complete(req, ret, 0); /* will drop i/o ref to req */ > > return 0; > > .... > > > > } > > > > > > > > Thanks, > > Badari
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |