When the number of available events in the ring buffer is calculated, the avail calculation is incorrect when head == tail. This is harmless in aio_read_events_ring(), but in free_ioctx() leads to the subsequent WARN_ON(atomic_read(&ctx->reqs_available) > ctx->nr). Correct this.
Signed-off-by: Benjamin LaHaise <[email protected]> --- fs/aio.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index 24ba228..dc52b0c 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -337,7 +337,8 @@ static void free_ioctx(struct kioctx *ctx) while (atomic_read(&ctx->reqs_available) < ctx->nr) { wait_event(ctx->wait, head != ctx->shadow_tail); - avail = (head < ctx->shadow_tail ? ctx->shadow_tail : ctx->nr) - head; + avail = (head <= ctx->shadow_tail ? + ctx->shadow_tail : ctx->nr) - head; atomic_add(avail, &ctx->reqs_available); head += avail; @@ -884,7 +885,7 @@ static long aio_read_events_ring(struct kioctx *ctx, goto out; while (ret < nr) { - long avail = (head < ctx->shadow_tail + long avail = (head <= ctx->shadow_tail ? ctx->shadow_tail : ctx->nr) - head; struct io_event *ev; struct page *page; -- 1.7.4.1 -- "Thought is the essence of where you are now." -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
