aio: correct calculation of available events

When the number of available events in the ring buffer is calculated, the
avail calculation is incorrect when head == tail.  This is harmless in
aio_read_events_ring(), but in free_ioctx() leads to the subsequent
WARN_ON(atomic_read(&ctx->reqs_available) > ctx->nr).  Correct this.

Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
Reviewed-by: Kent Overstreet <koverstreet@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/fs/aio.c b/fs/aio.c
index 36c1944f6ea87790d32e24733b01812efee1c0ce..850dae3c92fa2199c4b14201ac738b313976453c 100644 (file)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -337,7 +337,8 @@ static void free_ioctx(struct kioctx *ctx)
        while (atomic_read(&ctx->reqs_available) < ctx->nr) {
                wait_event(ctx->wait, head != ctx->shadow_tail);
 
-               avail = (head < ctx->shadow_tail ? ctx->shadow_tail : ctx->nr) - head;
+               avail = (head <= ctx->shadow_tail ?
+                        ctx->shadow_tail : ctx->nr) - head;
 
                atomic_add(avail, &ctx->reqs_available);
                head += avail;
@@ -885,7 +886,7 @@ static long aio_read_events_ring(struct kioctx *ctx,
                goto out;
 
        while (ret < nr) {
-               long avail = (head < ctx->shadow_tail
+               long avail = (head <= ctx->shadow_tail
                              ? ctx->shadow_tail : ctx->nr) - head;
                struct io_event *ev;
                struct page *page;