From: Nick Piggin <npiggin-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: Chuck Lever <chuck.lever-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
Cc: Trond Myklebust
<Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA@public.gmane.org>,
linux-fsdevel
<linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
Linux NFS Mailing List
<linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>
Subject: Re: NFS dio aio bug
Date: Sat, 15 Jan 2011 08:48:24 +1100 [thread overview]
Message-ID: <AANLkTikE8CT=6XQn550Cw6V0B7GWezpeUrhctFN8vSE7@mail.gmail.com> (raw)
In-Reply-To: <4E70BD9B-DB23-42EC-B28D-998E16FEC189-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
On Sat, Jan 15, 2011 at 3:08 AM, Chuck Lever <chuck.lever-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org> wrote:
> Hi Nick-
>
> On Jan 13, 2011, at 8:29 PM, Nick Piggin wrote:
>
>> Hi Trond,
>>
>> I'm getting use after frees in aio code in NFS
>
> Can you describe how to reproduce this?
It was with the aio-dio stress code from xfstests, #207 I think
or 208.
Running it for a short time and then ^C ing it would tend to
trigger it.
I'll have to get you more details after I come back from
travelling in a week's time.
>
>> [ 2703.396766] Call Trace:
>> [ 2703.396858] [<ffffffff8100b057>] ? native_sched_clock+0x27/0x80
>> [ 2703.396959] [<ffffffff8108509e>] ? put_lock_stats+0xe/0x40
>> [ 2703.397058] [<ffffffff81088348>] ? lock_release_holdtime+0xa8/0x140
>> [ 2703.397159] [<ffffffff8108a2a5>] lock_acquire+0x95/0x1b0
>> [ 2703.397260] [<ffffffff811627db>] ? aio_put_req+0x2b/0x60
>> [ 2703.397361] [<ffffffff81039701>] ? get_parent_ip+0x11/0x50
>> [ 2703.397464] [<ffffffff81612a31>] _raw_spin_lock_irq+0x41/0x80
>> [ 2703.397564] [<ffffffff811627db>] ? aio_put_req+0x2b/0x60
>> [ 2703.397662] [<ffffffff811627db>] aio_put_req+0x2b/0x60
>> [ 2703.397761] [<ffffffff811647fe>] do_io_submit+0x2be/0x7c0
>> [ 2703.397895] [<ffffffff81164d0b>] sys_io_submit+0xb/0x10
>> [ 2703.397995] [<ffffffff8100307b>] system_call_fastpath+0x16/0x1b
>>
>> Adding some tracing, it is due to nfs completing the request then
>> returning something other than -EIOCBQUEUED, so aio.c
>> also completes the request.
>
> Is this with reads, writes, or both? Are the I/O requests smaller than, equal to, or larger than rsize or wsize?
>
> We have a related bug report: hitting the BUG at fs/aio.c:552 (OEL5) and similar for more recent kernels. Looks like dreq refcounting is faulty somehow.
I only saw it with writes. The request was being completed
in nfs direct write path when I added some tracing. It was
very easy to reproduce, I just didn't have time to bisect it,
but I can do that when I get back if you don't have it solved
by then.
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2011-01-14 21:48 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-14 1:29 NFS dio aio bug Nick Piggin
2011-01-14 16:08 ` Chuck Lever
[not found] ` <4E70BD9B-DB23-42EC-B28D-998E16FEC189-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
2011-01-14 21:48 ` Nick Piggin [this message]
[not found] ` <AANLkTikE8CT=6XQn550Cw6V0B7GWezpeUrhctFN8vSE7-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2011-01-18 22:01 ` Chuck Lever
[not found] ` <D4A3D0CB-DA82-4E2E-BCAD-B03108AA4284-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
2011-01-19 2:56 ` Wengang Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='AANLkTikE8CT=6XQn550Cw6V0B7GWezpeUrhctFN8vSE7@mail.gmail.com' \
--to=npiggin-re5jqeeqqe8avxtiumwx3w@public.gmane.org \
--cc=Trond.Myklebust-HgOvQuBEEgTQT0dZR+AlfA@public.gmane.org \
--cc=chuck.lever-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org \
--cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).