From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:52691)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1Te4dp-0004jC-RO
	for qemu-devel@nongnu.org; Thu, 29 Nov 2012 08:59:05 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1Te4dj-0001tO-5f
	for qemu-devel@nongnu.org; Thu, 29 Nov 2012 08:59:01 -0500
Received: from mail-ea0-f173.google.com ([209.85.215.173]:49416)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@gmail.com>) id 1Te4di-0001t4-VN
	for qemu-devel@nongnu.org; Thu, 29 Nov 2012 08:58:55 -0500
Received: by mail-ea0-f173.google.com with SMTP id i13so6001771eaa.4
	for <qemu-devel@nongnu.org>; Thu, 29 Nov 2012 05:58:54 -0800 (PST)
Date: Thu, 29 Nov 2012 14:58:51 +0100
From: Stefan Hajnoczi <stefanha@gmail.com>
Message-ID: <20121129135851.GA13694@stefanha-thinkpad.redhat.com>
References: <1353578419-5481-1-git-send-email-s.priebe@profihost.ag>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1353578419-5481-1-git-send-email-s.priebe@profihost.ag>
Subject: Re: [Qemu-devel] [PATCH] rbd block driver fix race between aio
 completition and aio cancel
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Priebe <s.priebe@profihost.ag>
Cc: josh.durgin@inktank.com, ceph-devel@vger.kernel.org, qemu-devel@nongnu.org, pbonzini@redhat.com

On Thu, Nov 22, 2012 at 11:00:19AM +0100, Stefan Priebe wrote:
> @@ -406,10 +401,11 @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
>              acb->ret = r;
>          }
>      }
> +    acb->status = 0;
> +

I suggest doing this in the BH.  The qemu_aio_wait() loop in
qemu_rbd_aio_cancel() needs to wait until the BH has executed.  By
clearing status in the BH we ensure that no matter in which order
qemu_aio_wait() invokes BHs and callbacks, we'll always wait until the
BH has completed before ending the while loop in qemu_rbd_aio_cancel().

> @@ -737,7 +741,8 @@ static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
>  failed:
>      g_free(rcb);
>      s->qemu_aio_count--;
> -    qemu_aio_release(acb);
> +    if (!acb->cancelled)
> +        qemu_aio_release(acb);
>      return NULL;
>  }

This scenario is impossible.  We haven't returned the acb back to the
caller yet so they could not have invoked qemu_aio_cancel().

Stefan