Re: AIO Oops on 2.6.3-mm3

[Badari Pulavarty <pbadari@us.ibm.com>]

On Tuesday 02 March 2004 10:57 am, Daniel McNeil wrote:
> I fixed reference counting when the i/o completed before the
> submit path was done referencing the iocb.  This looks
> similar except it is getting a fault. 

I wonder whats different here. Even in this case, IO did complete
with EFAULT. 

Just for argument, if the IO completed correctly (without errors) -
how would it not run into this ? io_submit_one() will call
aio_complete() is the return code is NOT -EIOCBQUEUED.
Isn't it ? How do we prevent calling aio_complete() twice ?

Thanks,
Badari



> > I found the problem.. But no fix yet !!
> >
> > Here is whats happening..
> >
> > io_submit_one() :
> >
> > 	gets iocb with 2 refs
> > 	calls file->f_op->aio_write() which returns EFAULT...
> > 		This calls aio_complete() with EFAULT. aio_complete() drops a ref.
> > 	calls  aio_put_req() which drops a ref - since the count is
> > 			zero it frees iocb.
> > 	Since we got EFAULT, io_submit_one() calls aio_complete()
> > 			with freed up iocb - so we get OOPS.
> >
> > The problem here is we are calling aio_complete() twice.
> >
> > Daneil, didn't you fix this earlier ?
> >
> > int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
> > {
> >
> > 	...
> > 	 req = aio_get_req(ctx);         /* returns with 2 references to req */
> > 	..
> > 	case IOCB_CMD_PWRITE:
> > 		...
> > 		ret = file->f_op->aio_write(req, buf,
> >                                         iocb->aio_nbytes, req->ki_pos);
> > 	...
> > 	aio_put_req(req);       /* drop extra ref to req */
> >         if (likely(-EIOCBQUEUED == ret))
> >                 return 0;
> >         aio_complete(req, ret, 0);      /* will drop i/o ref to req */
> >         return 0;
> > 	....
> >
> > }
> >
> >
> >
> > Thanks,
> > Badari