From mboxrd@z Thu Jan  1 00:00:00 1970
From: Nick Piggin <npiggin@gmail.com>
Subject: NFS dio aio bug
Date: Fri, 14 Jan 2011 12:29:18 +1100
Message-ID: <AANLkTinjkvVySCA93F+p66KrTuqMfMF064ggNSg0yauX@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
To: Trond Myklebust <Trond.Myklebust@netapp.com>,
	linux-fsdevel <linux-fsdevel@vger.kernel.org>
Return-path: <linux-fsdevel-owner@vger.kernel.org>
Received: from mail-ww0-f44.google.com ([74.125.82.44]:44728 "EHLO
	mail-ww0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1752451Ab1ANB3U (ORCPT
	<rfc822;linux-fsdevel@vger.kernel.org>);
	Thu, 13 Jan 2011 20:29:20 -0500
Received: by wwa36 with SMTP id 36so2488596wwa.1
        for <linux-fsdevel@vger.kernel.org>; Thu, 13 Jan 2011 17:29:19 -0800 (PST)
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

Hi Trond,

I'm getting use after frees in aio code in NFS

[ 2703.396766] Call Trace:
[ 2703.396858]  [<ffffffff8100b057>] ? native_sched_clock+0x27/0x80
[ 2703.396959]  [<ffffffff8108509e>] ? put_lock_stats+0xe/0x40
[ 2703.397058]  [<ffffffff81088348>] ? lock_release_holdtime+0xa8/0x140
[ 2703.397159]  [<ffffffff8108a2a5>] lock_acquire+0x95/0x1b0
[ 2703.397260]  [<ffffffff811627db>] ? aio_put_req+0x2b/0x60
[ 2703.397361]  [<ffffffff81039701>] ? get_parent_ip+0x11/0x50
[ 2703.397464]  [<ffffffff81612a31>] _raw_spin_lock_irq+0x41/0x80
[ 2703.397564]  [<ffffffff811627db>] ? aio_put_req+0x2b/0x60
[ 2703.397662]  [<ffffffff811627db>] aio_put_req+0x2b/0x60
[ 2703.397761]  [<ffffffff811647fe>] do_io_submit+0x2be/0x7c0
[ 2703.397895]  [<ffffffff81164d0b>] sys_io_submit+0xb/0x10
[ 2703.397995]  [<ffffffff8100307b>] system_call_fastpath+0x16/0x1b

Adding some tracing, it is due to nfs completing the request then
returning something other than -EIOCBQUEUED, so aio.c
also completes the request.

Thanks,
Nick