From da90382c2ec367aac88ff6aa76afb659ee0e4235 Mon Sep 17 00:00:00 2001 From: Benjamin LaHaise Date: Mon, 5 Aug 2013 13:21:43 -0400 Subject: [PATCH] aio: fix error handling and rcu usage in "convert the ioctx list to table lookup v3" In the patch "aio: convert the ioctx list to table lookup v3", incorrect handling in the ioctx_alloc() error path was introduced that lead to an ioctx being added via ioctx_add_table() while freed when the ioctx_alloc() call returned -EAGAIN due to hitting the aio_max_nr limit. Fix this by only calling ioctx_add_table() as the last step in ioctx_alloc(). Also, several unnecessary rcu_dereference() calls were added that lead to RCU warnings where the system was already protected by a spin lock for accessing mm->ioctx_table. Signed-off-by: Benjamin LaHaise --- fs/aio.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index 588aff9dc316..3bc068c1cb9c 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -475,7 +475,7 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm) struct aio_ring *ring; spin_lock(&mm->ioctx_lock); - table = rcu_dereference(mm->ioctx_table); + table = mm->ioctx_table; while (1) { if (table) @@ -503,7 +503,7 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm) table->nr = new_nr; spin_lock(&mm->ioctx_lock); - old = rcu_dereference(mm->ioctx_table); + old = mm->ioctx_table; if (!old) { rcu_assign_pointer(mm->ioctx_table, table); @@ -579,10 +579,6 @@ static struct kioctx *ioctx_alloc(unsigned nr_events) if (ctx->req_batch < 1) ctx->req_batch = 1; - err = ioctx_add_table(ctx, mm); - if (err) - goto out_cleanup_noerr; - /* limit the number of system wide aios */ spin_lock(&aio_nr_lock); if (aio_nr + nr_events > (aio_max_nr * 2UL) || @@ -595,13 +591,18 @@ static struct kioctx *ioctx_alloc(unsigned nr_events) percpu_ref_get(&ctx->users); /* io_setup() will drop this ref */ + err = ioctx_add_table(ctx, mm); + if (err) + goto out_cleanup_put; + pr_debug("allocated ioctx %p[%ld]: mm=%p mask=0x%x\n", ctx, ctx->user_id, mm, ctx->nr_events); return ctx; +out_cleanup_put: + percpu_ref_put(&ctx->users); out_cleanup: err = -EAGAIN; -out_cleanup_noerr: aio_free_ring(ctx); out_freepcpu: free_percpu(ctx->cpu); @@ -626,7 +627,7 @@ static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx) struct kioctx_table *table; spin_lock(&mm->ioctx_lock); - table = rcu_dereference(mm->ioctx_table); + table = mm->ioctx_table; WARN_ON(ctx != table->table[ctx->id]); table->table[ctx->id] = NULL; -- 2.39.5