Messages in this thread | | | Date | Mon, 8 Nov 2004 09:47:30 +0530 | From | Suparna Bhattacharya <> | Subject | Re: [PATCH] Oops in aio_free_ring on 2.6.9 |
| |
On Sat, Nov 06, 2004 at 07:43:33PM -0800, Linus Torvalds wrote: > > On Fri, 5 Nov 2004, Darrick J. Wong wrote: > > > > Next, the aio_setup_ring function tries to mmap a bunch of pages and > > fails, because in step 1 we used up all the address space. > > aio_setup_ring then calls aio_free_ring to tear all of this down. > > (fs/aio.c:143) > > > > aio_free_ring sees the block of struct page pointers and calls free_page > > (fs/aio.c:88) on the pointers without checking that they're not NULL. > > Unfortunately, they _are_ NULL and *oops*! My patch amends the function > > to include a null pointer check. > > I don't disagree with the bug, but I disagree with the fix. > > In my opinion, the problem is that "info->nr_pages" is _wrong_. It's wrong > because it has been initialized to a bogus value. > > I'd much prefer this alternate appended patch. Can you verify that it also > fixes the problem (we can drop the bogus info->nr_pages initialization, > because the context - including the info part - has been cleared when it > was allocated, so nr_pages should already have the _correct_ value of zero > at this point).
Since aio_free_ring uses comparison with info->internal_pages rather than nr_pages to decide whether to kfree(info->ring_pages), I see your point.
Regards Suparna
> > Linus > > ----- > ===== fs/aio.c 1.60 vs edited ===== > --- 1.60/fs/aio.c 2004-10-20 01:12:10 -07:00 > +++ edited/fs/aio.c 2004-11-06 19:41:45 -08:00 > @@ -118,8 +118,6 @@ > if (nr_pages < 0) > return -EINVAL; > > - info->nr_pages = nr_pages; > - > nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event); > > info->nr = 0; > -- > To unsubscribe, send a message with 'unsubscribe linux-aio' in > the body to majordomo@kvack.org. For more info on Linux AIO, > see: http://www.kvack.org/aio/ > Don't email: <a href=mailto:"aart@kvack.org">aart@kvack.org</a>
-- Suparna Bhattacharya (suparna@in.ibm.com) Linux Technology Center IBM Software Lab, India
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |