lkml.org 
[lkml]   [2004]   [Sep]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [Bug 3317] New: Kernel oops in aio_complete while running AIO application
From
Date
On Tue, 2004-08-31 at 08:18, Andrew Morton wrote:
> Begin forwarded message:
>
> Date: Tue, 31 Aug 2004 06:15:18 -0700
> From: bugme-daemon@osdl.org
> To: bugme-new@lists.osdl.org
> Subject: [Bugme-new] [Bug 3317] New: Kernel oops in aio_complete while running AIO application
>
>
> http://bugme.osdl.org/show_bug.cgi?id=3317
>

Hi Andrew,

I debugged this some more. Here is whats happening:

The test program used program text address as buffer to do the READ to.
DIO get_user_pages() returned EFAULT. We called finished_one_bio()
as part of dropping the ref. to dio. It called aio_complete().
do_direct_IO() returned EFAULT to the caller. aio_run_iocb() expects
to see EIOCBQUEUED/RETRY, otherwise it calls aio_complete() with the
"ret" value. This is where the second aio_complete() is coming from.
So we cleanup "req" and on the next de-ref we get OOPS.

The problem here is, finished_one_bio() shouldn't call aio_complete()
since no work has been done. I have a fix for this - can you verify this
? I am not really comfortable with this "tweaking". (I am not really
sure about IO errors like EIO etc. - if they can lead to calling
aio_complete() twice)


Fix is to call aio_complete() ONLY if there is something to report.
Note the we don't update dio->result with any error codes from
get_user_pages(), they just passed as "ret" value from do_direct_IO().

Thanks,
Badari







--- linux-2.6.9-rc1.org/fs/direct-io.c 2004-09-03 08:44:22.186328240 -0700
+++ linux-2.6.9-rc1/fs/direct-io.c 2004-09-03 08:45:48.382224472 -0700
@@ -235,7 +235,8 @@ static void finished_one_bio(struct dio
dio_complete(dio, dio->block_in_file << dio->blkbits,
dio->result);
/* Complete AIO later if falling back to buffered i/o */
- if (dio->result == dio->size || dio->rw == READ) {
+ if (dio->result == dio->size ||
+ ((dio->rw == READ) && dio->result)) {
aio_complete(dio->iocb, dio->result, 0);
kfree(dio);
return;
\
 
 \ /
  Last update: 2005-03-22 14:05    [W:0.029 / U:0.752 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site