69 lines
2.1 KiB
Diff
69 lines
2.1 KiB
Diff
|
From 69e4747ee9727d660b88d7e1efe0f4afcb35db1b Mon Sep 17 00:00:00 2001
|
||
|
|
From: Gleb Natapov <gleb@redhat.com>
|
||
|
|
Date: Sun, 8 Jan 2012 17:07:28 +0200
|
||
|
|
Subject: [PATCH] Unused iocbs in a batch should not be accounted as active.
|
||
|
|
|
||
|
|
Since commit 080d676de095 ("aio: allocate kiocbs in batches") iocbs are
|
||
|
|
allocated in a batch during processing of first iocbs. All iocbs in a
|
||
|
|
batch are automatically added to ctx->active_reqs list and accounted in
|
||
|
|
ctx->reqs_active.
|
||
|
|
|
||
|
|
If one (not the last one) of iocbs submitted by an user fails, further
|
||
|
|
iocbs are not processed, but they are still present in ctx->active_reqs
|
||
|
|
and accounted in ctx->reqs_active. This causes process to stuck in a D
|
||
|
|
state in wait_for_all_aios() on exit since ctx->reqs_active will never
|
||
|
|
go down to zero. Furthermore since kiocb_batch_free() frees iocb
|
||
|
|
without removing it from active_reqs list the list become corrupted
|
||
|
|
which may cause oops.
|
||
|
|
|
||
|
|
Fix this by removing iocb from ctx->active_reqs and updating
|
||
|
|
ctx->reqs_active in kiocb_batch_free().
|
||
|
|
|
||
|
|
Signed-off-by: Gleb Natapov <gleb@redhat.com>
|
||
|
|
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
|
||
|
|
Cc: stable@kernel.org # 3.2
|
||
|
|
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||
|
|
---
|
||
|
|
fs/aio.c | 11 +++++++++--
|
||
|
|
1 files changed, 9 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/fs/aio.c b/fs/aio.c
|
||
|
|
index 78c514c..969beb0 100644
|
||
|
|
--- a/fs/aio.c
|
||
|
|
+++ b/fs/aio.c
|
||
|
|
@@ -476,14 +476,21 @@ static void kiocb_batch_init(struct kiocb_batch *batch, long total)
|
||
|
|
batch->count = total;
|
||
|
|
}
|
||
|
|
|
||
|
|
-static void kiocb_batch_free(struct kiocb_batch *batch)
|
||
|
|
+static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
|
||
|
|
{
|
||
|
|
struct kiocb *req, *n;
|
||
|
|
|
||
|
|
+ if (list_empty(&batch->head))
|
||
|
|
+ return;
|
||
|
|
+
|
||
|
|
+ spin_lock_irq(&ctx->ctx_lock);
|
||
|
|
list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
|
||
|
|
list_del(&req->ki_batch);
|
||
|
|
+ list_del(&req->ki_list);
|
||
|
|
kmem_cache_free(kiocb_cachep, req);
|
||
|
|
+ ctx->reqs_active--;
|
||
|
|
}
|
||
|
|
+ spin_unlock_irq(&ctx->ctx_lock);
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
@@ -1742,7 +1749,7 @@ long do_io_submit(aio_context_t ctx_id, long nr,
|
||
|
|
}
|
||
|
|
blk_finish_plug(&plug);
|
||
|
|
|
||
|
|
- kiocb_batch_free(&batch);
|
||
|
|
+ kiocb_batch_free(ctx, &batch);
|
||
|
|
put_ioctx(ctx);
|
||
|
|
return i ? i : ret;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
1.7.7.5
|
||
|
|
|