From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stefan Priebe - Profihost AG Subject: Re: [PATCHv5] rbd block driver fix race between aio completition and aio cancel Date: Fri, 30 Nov 2012 09:57:53 +0100 Message-ID: <50B87511.1010100@profihost.ag> References: <1354225046-9761-1-git-send-email-s.priebe@profihost.ag> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mail.profihost.ag ([85.158.179.208]:60854 "EHLO mail.profihost.ag" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752115Ab2K3I6E (ORCPT ); Fri, 30 Nov 2012 03:58:04 -0500 In-Reply-To: Sender: ceph-devel-owner@vger.kernel.org List-ID: To: Stefan Hajnoczi Cc: qemu-devel , Josh Durgin , ceph-devel@vger.kernel.org, Paolo Bonzini fixed in V6 Am 30.11.2012 09:26, schrieb Stefan Hajnoczi: > On Thu, Nov 29, 2012 at 10:37 PM, Stefan Priebe wrote: >> @@ -568,6 +562,10 @@ static void qemu_rbd_aio_cancel(BlockDriverAIOCB *blockacb) >> { >> RBDAIOCB *acb = (RBDAIOCB *) blockacb; >> acb->cancelled = 1; >> + >> + while (acb->status == -EINPROGRESS) { >> + qemu_aio_wait(); >> + } >> } >> >> static const AIOCBInfo rbd_aiocb_info = { >> @@ -639,6 +637,7 @@ static void rbd_aio_bh_cb(void *opaque) >> acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret)); >> qemu_bh_delete(acb->bh); >> acb->bh = NULL; >> + acb->status = 0; >> >> qemu_aio_release(acb); >> } > > We cannot release acb in rbd_aio_bh_cb() when acb->cancelled == 1 > because qemu_rbd_aio_cancel() still accesses it. This was discussed > in an early version of the patch. > > Stefan > From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:47592) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TeMQ9-0006St-70 for qemu-devel@nongnu.org; Fri, 30 Nov 2012 03:58:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TeMQ8-00019T-BE for qemu-devel@nongnu.org; Fri, 30 Nov 2012 03:58:05 -0500 Received: from mail.profihost.ag ([85.158.179.208]:48502) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TeMQ8-00019I-18 for qemu-devel@nongnu.org; Fri, 30 Nov 2012 03:58:04 -0500 Message-ID: <50B87511.1010100@profihost.ag> Date: Fri, 30 Nov 2012 09:57:53 +0100 From: Stefan Priebe - Profihost AG MIME-Version: 1.0 References: <1354225046-9761-1-git-send-email-s.priebe@profihost.ag> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCHv5] rbd block driver fix race between aio completition and aio cancel List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Hajnoczi Cc: Josh Durgin , ceph-devel@vger.kernel.org, qemu-devel , Paolo Bonzini fixed in V6 Am 30.11.2012 09:26, schrieb Stefan Hajnoczi: > On Thu, Nov 29, 2012 at 10:37 PM, Stefan Priebe wrote: >> @@ -568,6 +562,10 @@ static void qemu_rbd_aio_cancel(BlockDriverAIOCB *blockacb) >> { >> RBDAIOCB *acb = (RBDAIOCB *) blockacb; >> acb->cancelled = 1; >> + >> + while (acb->status == -EINPROGRESS) { >> + qemu_aio_wait(); >> + } >> } >> >> static const AIOCBInfo rbd_aiocb_info = { >> @@ -639,6 +637,7 @@ static void rbd_aio_bh_cb(void *opaque) >> acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret)); >> qemu_bh_delete(acb->bh); >> acb->bh = NULL; >> + acb->status = 0; >> >> qemu_aio_release(acb); >> } > > We cannot release acb in rbd_aio_bh_cb() when acb->cancelled == 1 > because qemu_rbd_aio_cancel() still accesses it. This was discussed > in an early version of the patch. > > Stefan >