path: root/fs/aio.c
diff options
authorGleb Natapov <gleb@redhat.com>2012-01-08 17:07:28 +0200
committerLinus Torvalds <torvalds@linux-foundation.org>2012-01-13 20:39:44 -0800
commit69e4747ee9727d660b88d7e1efe0f4afcb35db1b (patch)
tree2dde4642ad0dba19688b664c4397c61cf9ebce25 /fs/aio.c
parenta3301b751b19f0efbafddc4034f8e7ce6bf3007b (diff)
Unused iocbs in a batch should not be accounted as active.
Since commit 080d676de095 ("aio: allocate kiocbs in batches") iocbs are allocated in a batch during processing of first iocbs. All iocbs in a batch are automatically added to ctx->active_reqs list and accounted in ctx->reqs_active. If one (not the last one) of iocbs submitted by an user fails, further iocbs are not processed, but they are still present in ctx->active_reqs and accounted in ctx->reqs_active. This causes process to stuck in a D state in wait_for_all_aios() on exit since ctx->reqs_active will never go down to zero. Furthermore since kiocb_batch_free() frees iocb without removing it from active_reqs list the list become corrupted which may cause oops. Fix this by removing iocb from ctx->active_reqs and updating ctx->reqs_active in kiocb_batch_free(). Signed-off-by: Gleb Natapov <gleb@redhat.com> Reviewed-by: Jeff Moyer <jmoyer@redhat.com> Cc: stable@kernel.org # 3.2 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/aio.c')
1 files changed, 9 insertions, 2 deletions
diff --git a/fs/aio.c b/fs/aio.c
index 78c514cfd212..969beb0e2231 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -476,14 +476,21 @@ static void kiocb_batch_init(struct kiocb_batch *batch, long total)
batch->count = total;
-static void kiocb_batch_free(struct kiocb_batch *batch)
+static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
struct kiocb *req, *n;
+ if (list_empty(&batch->head))
+ return;
+ spin_lock_irq(&ctx->ctx_lock);
list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
+ list_del(&req->ki_list);
kmem_cache_free(kiocb_cachep, req);
+ ctx->reqs_active--;
+ spin_unlock_irq(&ctx->ctx_lock);
@@ -1742,7 +1749,7 @@ long do_io_submit(aio_context_t ctx_id, long nr,
- kiocb_batch_free(&batch);
+ kiocb_batch_free(ctx, &batch);
return i ? i : ret;