Fix segfault with verify_async

At some point the filename was added to the report on verify failures,
however this broke verify_async, as the file pointer on the io_u is
set to NULL before the verify thread sees the io_u.  The result is a
segfault when there is a verify mismatch.

This patch changes the semantics of a deferred free (IO_U_F_FREE_DEF)
to have already called put_file, but not set the file pointer to NULL.
 This is safe to do as the file list is only freed after all the
verify threads have been terminated.

FYI - this is the minimal config to cause the error this patch fixes,
and is what I used to test the fix.  (Not using thread still causes a
segfault, but it is reported more subtly since just a sub-process hits
it.)

[segv]
ioengine=null
size=4k
verify=meta
rw=read
thread
verify_async=1

Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_u.c b/io_u.c
index 4dcb1fce44dbbeb4478de8154e502af4eb9f7d32..79714091804c0443d6fa9fb4d47906bd4dedb13b 100644 (file)
--- a/io_u.c
+++ b/io_u.c
@@ -597,13 +597,12 @@ void put_io_u(struct thread_data *td, struct io_u *io_u)
 {
        td_io_u_lock(td);
 
-       io_u->flags |= IO_U_F_FREE;
-       io_u->flags &= ~IO_U_F_FREE_DEF;
-
-       if (io_u->file)
+       if (io_u->file && !(io_u->flags & IO_U_F_FREE_DEF))
                put_file_log(td, io_u->file);
-
        io_u->file = NULL;
+       io_u->flags &= ~IO_U_F_FREE_DEF;
+       io_u->flags |= IO_U_F_FREE;
+
        if (io_u->flags & IO_U_F_IN_CUR_DEPTH)
                td->cur_depth--;
        flist_del_init(&io_u->list);

diff --git a/verify.c b/verify.c
index 43dd392687ee53fac4d28161f3ee42514a6c907f..5a9428177eef68b58f9fc9d4e6cfa6596d756688 100644 (file)
--- a/verify.c
+++ b/verify.c
@@ -602,10 +602,8 @@ int verify_io_u_async(struct thread_data *td, struct io_u *io_u)
        if (io_u->file)
                put_file_log(td, io_u->file);
 
-       io_u->file = NULL;
-
        pthread_mutex_lock(&td->io_u_lock);
-       
+
        if (io_u->flags & IO_U_F_IN_CUR_DEPTH) {
                td->cur_depth--;
                io_u->flags &= ~IO_U_F_IN_CUR_DEPTH;