Commit 69e4747e authored by Gleb Natapov's avatar Gleb Natapov Committed by Linus Torvalds

Unused iocbs in a batch should not be accounted as active.

Since commit 080d676d ("aio: allocate kiocbs in batches") iocbs are
allocated in a batch during processing of first iocbs.  All iocbs in a
batch are automatically added to ctx->active_reqs list and accounted in
ctx->reqs_active.

If one (not the last one) of iocbs submitted by an user fails, further
iocbs are not processed, but they are still present in ctx->active_reqs
and accounted in ctx->reqs_active.  This causes process to stuck in a D
state in wait_for_all_aios() on exit since ctx->reqs_active will never
go down to zero.  Furthermore since kiocb_batch_free() frees iocb
without removing it from active_reqs list the list become corrupted
which may cause oops.

Fix this by removing iocb from ctx->active_reqs and updating
ctx->reqs_active in kiocb_batch_free().
Signed-off-by: default avatarGleb Natapov <gleb@redhat.com>
Reviewed-by: default avatarJeff Moyer <jmoyer@redhat.com>
Cc: stable@kernel.org   # 3.2
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent a3301b75
...@@ -476,14 +476,21 @@ static void kiocb_batch_init(struct kiocb_batch *batch, long total) ...@@ -476,14 +476,21 @@ static void kiocb_batch_init(struct kiocb_batch *batch, long total)
batch->count = total; batch->count = total;
} }
static void kiocb_batch_free(struct kiocb_batch *batch) static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
{ {
struct kiocb *req, *n; struct kiocb *req, *n;
if (list_empty(&batch->head))
return;
spin_lock_irq(&ctx->ctx_lock);
list_for_each_entry_safe(req, n, &batch->head, ki_batch) { list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
list_del(&req->ki_batch); list_del(&req->ki_batch);
list_del(&req->ki_list);
kmem_cache_free(kiocb_cachep, req); kmem_cache_free(kiocb_cachep, req);
ctx->reqs_active--;
} }
spin_unlock_irq(&ctx->ctx_lock);
} }
/* /*
...@@ -1742,7 +1749,7 @@ long do_io_submit(aio_context_t ctx_id, long nr, ...@@ -1742,7 +1749,7 @@ long do_io_submit(aio_context_t ctx_id, long nr,
} }
blk_finish_plug(&plug); blk_finish_plug(&plug);
kiocb_batch_free(&batch); kiocb_batch_free(ctx, &batch);
put_ioctx(ctx); put_ioctx(ctx);
return i ? i : ret; return i ? i : ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment