From: Dave Chinner <david@fromorbit.com>
To: Christoph Hellwig <hch@infradead.org>
Cc: Eric Sandeen <sandeen@redhat.com>,
Brian Foster <bfoster@redhat.com>, xfs-oss <xfs@oss.sgi.com>
Subject: Re: [PATCH] xfs: fix buffer use after free on IO error
Date: Wed, 26 Mar 2014 05:08:14 +1100 [thread overview]
Message-ID: <20140325180814.GF18572@destitution> (raw)
In-Reply-To: <20140325131705.GB25392@infradead.org>
On Tue, Mar 25, 2014 at 06:17:05AM -0700, Christoph Hellwig wrote:
> > On Fri, Mar 21, 2014 at 09:48:50PM -0500, Eric Sandeen wrote:
> > > + /*
> > > + * If _xfs_buf_ioapply failed, we'll get back here with
> > > + * only the reference we took above. _xfs_buf_ioend will
> > > + * drop it to zero, so we'd better not queue it for later,
> > > + * or we'll free it before it's done.
> > > + */
> > > + _xfs_buf_ioend(bp, bp->b_error ? 0 : 1);
> > >
> >
> > Out of curiosity, is there any major reason we don't use 0 here
> > unconditionally? Are we worried about I/O completing before we have a
> > chance to decrement the reference?
>
> I think this should unconditionally avoid the schedule, and while we're
> at it we should kill _xfs_buf_ioend and opencode it here and at the
> other callsite.
I thought we schduled here because we can issue IO from IO
completion and so we need to requeue the IO completion rather than
run it inline in the current IO completion that hasn't fully
completed it's processing yet..
> Also atomic_dec_and_test really just returns true/false - there should
> ne no need for the explicit == 1 in the conditional.
Right, there's several other cleanups around this code that can be
done as Eric has mentioned...
Cheers,
Dave.
--
Dave Chinner
david@fromorbit.com
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
next prev parent reply other threads:[~2014-03-25 18:08 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-22 2:48 [PATCH] xfs: fix buffer use after free on IO error Eric Sandeen
2014-03-25 12:58 ` Brian Foster
2014-03-25 13:17 ` Christoph Hellwig
2014-03-25 16:05 ` Eric Sandeen
2014-03-25 17:25 ` Christoph Hellwig
2014-03-25 17:39 ` Eric Sandeen
2014-03-25 17:44 ` Christoph Hellwig
2014-03-25 18:08 ` Dave Chinner [this message]
2014-03-25 18:13 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140325180814.GF18572@destitution \
--to=david@fromorbit.com \
--cc=bfoster@redhat.com \
--cc=hch@infradead.org \
--cc=sandeen@redhat.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox