On Wed, Feb 13, 2013 at 12:45:52PM -0500, Benjamin LaHaise wrote: > When the number of available events in the ring buffer is calculated, > the avail calculation is incorrect when head == tail. This is harmless > in aio_read_events_ring(), but in free_ioctx() leads to the subsequent > WARN_ON(atomic_read(&ctx->reqs_available) > ctx->nr). Correct this. > > Signed-off-by: Benjamin LaHaise <[email protected]> > --- > fs/aio.c | 5 +++-- > 1 files changed, 3 insertions(+), 2 deletions(-) > > diff --git a/fs/aio.c b/fs/aio.c > index 24ba228..dc52b0c 100644 > --- a/fs/aio.c > +++ b/fs/aio.c > @@ -337,7 +337,8 @@ static void free_ioctx(struct kioctx *ctx) > while (atomic_read(&ctx->reqs_available) < ctx->nr) { > wait_event(ctx->wait, head != ctx->shadow_tail); > > - avail = (head < ctx->shadow_tail ? ctx->shadow_tail : ctx->nr) > - head; > + avail = (head <= ctx->shadow_tail ? > + ctx->shadow_tail : ctx->nr) - head; > > atomic_add(avail, &ctx->reqs_available); > head += avail; > @@ -884,7 +885,7 @@ static long aio_read_events_ring(struct kioctx *ctx, > goto out; > > while (ret < nr) { > - long avail = (head < ctx->shadow_tail > + long avail = (head <= ctx->shadow_tail > ? ctx->shadow_tail : ctx->nr) - head; > struct io_event *ev; > struct page *page; > -- > 1.7.4.1 > > > -- > "Thought is the essence of where you are now."
Whoops! Reviewed-by: Kent Overstreet <[email protected]> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
