From patchwork Tue Apr 10 12:00:53 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Changwei Ge X-Patchwork-Id: 10332863 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0AB6060365 for ; Tue, 10 Apr 2018 12:01:51 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EE48F28AB5 for ; Tue, 10 Apr 2018 12:01:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E2BA028DAE; Tue, 10 Apr 2018 12:01:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) (using TLSv1.2 with cipher AES256-SHA256 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5246A28AB5 for ; Tue, 10 Apr 2018 12:01:50 +0000 (UTC) Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w3AC0k0I133486; Tue, 10 Apr 2018 12:01:10 GMT Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp2130.oracle.com with ESMTP id 2h6ne79vrk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 10 Apr 2018 12:01:10 +0000 Received: from oss.oracle.com (oss-old-reserved.oracle.com [137.254.22.2]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w3AC17sg027963 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 10 Apr 2018 12:01:08 GMT Received: from localhost ([127.0.0.1] helo=lb-oss.oracle.com) by oss.oracle.com with esmtp (Exim 4.63) (envelope-from ) id 1f5rxT-0006lz-MZ; Tue, 10 Apr 2018 05:01:07 -0700 Received: from userv0022.oracle.com ([156.151.31.74]) by oss.oracle.com with esmtp (Exim 4.63) (envelope-from ) id 1f5rwq-0006iP-G5 for ocfs2-devel@oss.oracle.com; Tue, 10 Apr 2018 05:00:28 -0700 Received: from userp2030.oracle.com (userp2030.oracle.com [156.151.31.89]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w3AC0RnJ010883 (version=TLSv1/SSLv3 cipher=AES256-SHA256 bits=256 verify=FAIL); Tue, 10 Apr 2018 12:00:28 GMT Received: from pps.filterd (userp2030.oracle.com [127.0.0.1]) by userp2030.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w3ABqonb047028; Tue, 10 Apr 2018 12:00:27 GMT Received: from h3cmg01-ex.h3c.com (smtp.h3c.com [60.191.123.56]) by userp2030.oracle.com with ESMTP id 2h8ts1jghp-1; Tue, 10 Apr 2018 12:00:26 +0000 Received: from BJHUB01-EX.srv.huawei-3com.com (unknown [10.63.20.169]) by h3cmg01-ex.h3c.com with smtp id 2e7f_02ab_901e673f_8fd1_4314_b4ec_29886b81dfcc; Tue, 10 Apr 2018 19:59:45 +0800 Received: from localhost.localdomain (10.125.136.231) by rndsmtp.h3c.com (10.63.20.174) with Microsoft SMTP Server id 14.3.248.2; Tue, 10 Apr 2018 19:59:34 +0800 From: Changwei Ge To: , , , Date: Tue, 10 Apr 2018 20:00:53 +0800 Message-ID: <1523361653-14439-1-git-send-email-ge.changwei@h3c.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 X-Originating-IP: [10.125.136.231] X-CLX-Shades: MLX X-CLX-Response: 1TFkXGx0YEQpMehcaEQpZTRdnZnIRCllJFxpxGhAadwYbHxhxGRgQGncGGBo GGhEKWV4XaG55EQpJRhdFWEtJRk91WlhFTl9JXkNFRBl1T0sRCkNOF0JQR0FGUkdZbUkZZxNBQx 5lcF8HRxgTHWJlaV1JQGVTEQpYXBcfBBoEGxkYB0gaSR4ZHxkeBRsaBBsaGgQeEgQbEBseGh8aE QpeWRd5a0FcGBEKTVwXGR0SEQpMWhdoaUJNeREKTU4XaBEKQ1oXHBoEGxMbBBsYGQQfHBEKQl4X GxEKRFgXGBEKRF4XHhEKREkXGREKQkYXZxNtYBtbZUIffn0RCkJcFxoRCkJFF24ZWExeYQFwUkx hEQpCThdkQnxaRURBYh1kUBEKQkwXb35dTRgFXWYaUnsRCkJsF2RhT0tgQkgSeB1nEQpCQBdkfR lzYgFrXmYSGxEKWlgXGBEKcGgXaWQYTVJMfn5HREUQGhEKcGgXZl0dZE1rU0VTBVkQGhEKcGgXZ x9+SHJpaUlzEm8QGhEKcGgXZ0VkQ0Bvb2Z+E04QGhEKcGgXYHpBTXoFUGlQf2QQGhEKcGwXbU4b b1MBR1JIHXMQGRoRCm1+FxoRClhNF0sRIA== X-PDR: PASS X-Source-IP: 60.191.123.56 X-ServerName: smtp.h3c.com X-Proofpoint-SPF-Result: pass X-Proofpoint-SPF-Record: v=spf1 ip4:60.191.123.56 ip4:60.191.123.50 ip4:221.12.31.13 ip4:221.12.31.56 X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8858 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=0 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=172 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=744 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1804100120 X-Spam: Clean Cc: ocfs2-devel@oss.oracle.com Subject: [Ocfs2-devel] [PATCH] ocfs2: don't use iocb when EIOCBQUEUED returns X-BeenThere: ocfs2-devel@oss.oracle.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: ocfs2-devel-bounces@oss.oracle.com Errors-To: ocfs2-devel-bounces@oss.oracle.com X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8858 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1804100121 X-Virus-Scanned: ClamAV using ClamSMTP When -EIOCBQUEUED returns, it means that aio_complete() will be called from dio_complete(), which is an asynchronous progress against write_iter. Generally, IO is a very slow progress than executing instruction, but we still can't take the risk to access a freed iocb. And we do face a BUG crash issue. >From crash tool, iocb is obviously freed already. crash> struct -x kiocb ffff881a350f5900 struct kiocb { ki_filp = 0xffff881a350f5a80, ki_pos = 0x0, ki_complete = 0x0, private = 0x0, ki_flags = 0x0 } And the backtrace shows: ocfs2_file_write_iter+0xcaa/0xd00 [ocfs2] ? ocfs2_check_range_for_refcount+0x150/0x150 [ocfs2] aio_run_iocb+0x229/0x2f0 ? try_to_wake_up+0x380/0x380 do_io_submit+0x291/0x540 ? syscall_trace_leave+0xad/0x130 SyS_io_submit+0x10/0x20 system_call_fastpath+0x16/0x75 Signed-off-by: Changwei Ge --- fs/ocfs2/file.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index 5d1784a..1393ff2 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -2343,7 +2343,7 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb, written = __generic_file_write_iter(iocb, from); /* buffered aio wouldn't have proper lock coverage today */ - BUG_ON(written == -EIOCBQUEUED && !(iocb->ki_flags & IOCB_DIRECT)); + BUG_ON(written == -EIOCBQUEUED && !direct_io); /* * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io @@ -2463,7 +2463,7 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb, trace_generic_file_aio_read_ret(ret); /* buffered aio wouldn't have proper lock coverage today */ - BUG_ON(ret == -EIOCBQUEUED && !(iocb->ki_flags & IOCB_DIRECT)); + BUG_ON(ret == -EIOCBQUEUED && !direct_io); /* see ocfs2_file_write_iter */ if (ret == -EIOCBQUEUED || !ocfs2_iocb_is_rw_locked(iocb)) {