kernel.git/fs/aio.c, branch linux-2.6.19.y

aio: fix buggy put_ioctx call in aio_complete - v2

2007-02-24T00:24:25Z

An AIO bug was reported that sleeping function is being called in softirq context: BUG: warning at kernel/mutex.c:132/__mutex_lock_common() Call Trace: [] __mutex_lock_slowpath+0x640/0x6c0 [] mutex_lock+0x20/0x40 [] flush_workqueue+0xb0/0x1a0 [] __put_ioctx+0xc0/0x240 [] aio_complete+0x2f0/0x420 [] finished_one_bio+0x200/0x2a0 [] dio_bio_complete+0x1c0/0x200 [] dio_bio_end_aio+0x60/0x80 [] bio_endio+0x110/0x1c0 [] __end_that_request_first+0x180/0xba0 [] end_that_request_chunk+0x30/0x60 [] scsi_end_request+0x50/0x300 [scsi_mod] [] scsi_io_completion+0x200/0x8a0 [scsi_mod] [] sd_rw_intr+0x330/0x860 [sd_mod] [] scsi_finish_command+0x100/0x1c0 [scsi_mod] [] scsi_softirq_done+0x230/0x300 [scsi_mod] [] blk_done_softirq+0x160/0x1c0 [] __do_softirq+0x200/0x240 [] do_softirq+0x70/0xc0 See report: http://marc.theaimsgroup.com/?l=linux-kernel&m=116599593200888&w=2 flush_workqueue() is not allowed to be called in the softirq context. However, aio_complete() called from I/O interrupt can potentially call put_ioctx with last ref count on ioctx and triggers bug. It is simply incorrect to perform ioctx freeing from aio_complete. The bug is trigger-able from a race between io_destroy() and aio_complete(). A possible scenario: cpu0 cpu1 io_destroy aio_complete wait_for_all_aios { __aio_put_req ... ctx->reqs_active--; if (!ctx->reqs_active) return; } ... put_ioctx(ioctx) put_ioctx(ctx); __put_ioctx bam! Bug trigger! The real problem is that the condition check of ctx->reqs_active in wait_for_all_aios() is incorrect that access to reqs_active is not being properly protected by spin lock. This patch adds that protective spin lock, and at the same time removes all duplicate ref counting for each kiocb as reqs_active is already used as a ref count for each active ioctx. This also ensures that buggy call to flush_workqueue() in softirq context is eliminated. Signed-off-by: "Ken Chen" Cc: Zach Brown Cc: Suparna Bhattacharya Cc: Benjamin LaHaise Cc: Badari Pulavarty Acked-by: Jeff Moyer Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman

[PATCH] pr_debug: aio: use size_t length modifier in pr_debug format arguments

2006-10-03T15:04:19Z

aio: use size_t length modifier in pr_debug format arguments Signed-off-by: Zach Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] Add vector AIO support

2006-10-01T07:39:29Z

This work is initially done by Zach Brown to add support for vectored aio. These are the core changes for AIO to support IOCB_CMD_PREADV/IOCB_CMD_PWRITEV. [akpm@osdl.org: huge build fix] Signed-off-by: Zach Brown Signed-off-by: Christoph Hellwig Signed-off-by: Badari Pulavarty Acked-by: Benjamin LaHaise Acked-by: James Morris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] Vectorize aio_read/aio_write fileop methods

2006-10-01T07:39:28Z

This patch vectorizes aio_read() and aio_write() methods to prepare for collapsing all aio & vectored operations into one interface - which is aio_read()/aio_write(). Signed-off-by: Badari Pulavarty Signed-off-by: Christoph Hellwig Cc: Michael Holzheu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

spelling fixes

2006-06-26T16:35:02Z

acquired (aquired) contiguous (contigious) successful (succesful, succesfull) surprise (suprise) whether (weather) some other misspellings Signed-off-by: Andreas Mohr Signed-off-by: Adrian Bunk

[PATCH] list: use list_replace_init() instead of list_splice_init()

2006-06-23T14:43:07Z

list_splice_init(list, head) does unneeded job if it is known that list_empty(head) == 1. We can use list_replace_init() instead. Signed-off-by: Oleg Nesterov Acked-by: David S. Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] use kzalloc and kcalloc in core fs code

2006-03-25T16:23:00Z

Signed-off-by: Oliver Neukum Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] rcu file: use atomic primitives

2006-01-09T04:13:48Z

Use atomic_inc_not_zero for rcu files instead of special case rcuref. Signed-off-by: Nick Piggin Cc: "Paul E. McKenney" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] aio: replace locking comments with assert_spin_locked()

2005-11-14T02:14:16Z

aio: replace locking comments with assert_spin_locked() Signed-off-by: Zach Brown Acked-by: Benjamin LaHaise Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] aio: remove kioctx from mm_struct

2005-11-14T02:14:16Z

Sync iocbs have a life cycle that don't need a kioctx. Their retrying, if any, is done in the context of their owner who has allocated them on the stack. The sole user of a sync iocb's ctx reference was aio_complete() checking for an elevated iocb ref count that could never happen. No path which grabs an iocb ref has access to sync iocbs. If we were to implement sync iocb cancelation it would be done by the owner of the iocb using its on-stack reference. Removing this chunk from aio_complete allows us to remove the entire kioctx instance from mm_struct, reducing its size by a third. On a i386 testing box the slab size went from 768 to 504 bytes and from 5 to 8 per page. Signed-off-by: Zach Brown Acked-by: Benjamin LaHaise Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds