lkml.org 
[lkml]   [2004]   [Mar]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: AIO Oops on 2.6.3-mm3
Date
On Tuesday 02 March 2004 10:57 am, Daniel McNeil wrote:
> I fixed reference counting when the i/o completed before the
> submit path was done referencing the iocb. This looks
> similar except it is getting a fault.

I wonder whats different here. Even in this case, IO did complete
with EFAULT.

Just for argument, if the IO completed correctly (without errors) -
how would it not run into this ? io_submit_one() will call
aio_complete() is the return code is NOT -EIOCBQUEUED.
Isn't it ? How do we prevent calling aio_complete() twice ?

Thanks,
Badari



> > I found the problem.. But no fix yet !!
> >
> > Here is whats happening..
> >
> > io_submit_one() :
> >
> > gets iocb with 2 refs
> > calls file->f_op->aio_write() which returns EFAULT...
> > This calls aio_complete() with EFAULT. aio_complete() drops a ref.
> > calls aio_put_req() which drops a ref - since the count is
> > zero it frees iocb.
> > Since we got EFAULT, io_submit_one() calls aio_complete()
> > with freed up iocb - so we get OOPS.
> >
> > The problem here is we are calling aio_complete() twice.
> >
> > Daneil, didn't you fix this earlier ?
> >
> > int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
> > {
> >
> > ...
> > req = aio_get_req(ctx); /* returns with 2 references to req */
> > ..
> > case IOCB_CMD_PWRITE:
> > ...
> > ret = file->f_op->aio_write(req, buf,
> > iocb->aio_nbytes, req->ki_pos);
> > ...
> > aio_put_req(req); /* drop extra ref to req */
> > if (likely(-EIOCBQUEUED == ret))
> > return 0;
> > aio_complete(req, ret, 0); /* will drop i/o ref to req */
> > return 0;
> > ....
> >
> > }
> >
> >
> >
> > Thanks,
> > Badari

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:01    [W:0.050 / U:0.124 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site