From: Steven Lang <tirea@google.com>
Date: Wed, 26 Oct 2011 07:46:50 +0000 (+0200)
Subject: Fix segfault with verify_async
X-Git-Tag: fio-1.99.10~1
X-Git-Url: https://git.kernel.dk/?p=fio.git;a=commitdiff_plain;h=d7ee2a7d431c2cabdf56d04ca14805cad72cf985;ds=inline

Fix segfault with verify_async

At some point the filename was added to the report on verify failures,
however this broke verify_async, as the file pointer on the io_u is
set to NULL before the verify thread sees the io_u.  The result is a
segfault when there is a verify mismatch.

This patch changes the semantics of a deferred free (IO_U_F_FREE_DEF)
to have already called put_file, but not set the file pointer to NULL.
 This is safe to do as the file list is only freed after all the
verify threads have been terminated.

FYI - this is the minimal config to cause the error this patch fixes,
and is what I used to test the fix.  (Not using thread still causes a
segfault, but it is reported more subtly since just a sub-process hits
it.)

[segv]
ioengine=null
size=4k
verify=meta
rw=read
thread
verify_async=1

Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/io_u.c b/io_u.c
index d1f66a94..fc3ee498 100644
--- a/io_u.c
+++ b/io_u.c
@@ -597,13 +597,12 @@ void put_io_u(struct thread_data *td, struct io_u *io_u)
 {
 	td_io_u_lock(td);
 
-	io_u->flags |= IO_U_F_FREE;
-	io_u->flags &= ~IO_U_F_FREE_DEF;
-
-	if (io_u->file)
+	if (io_u->file && !(io_u->flags & IO_U_F_FREE_DEF))
 		put_file_log(td, io_u->file);
-
 	io_u->file = NULL;
+	io_u->flags &= ~IO_U_F_FREE_DEF;
+	io_u->flags |= IO_U_F_FREE;
+
 	if (io_u->flags & IO_U_F_IN_CUR_DEPTH)
 		td->cur_depth--;
 	flist_del_init(&io_u->list);
diff --git a/verify.c b/verify.c
index 43dd3926..5a942817 100644
--- a/verify.c
+++ b/verify.c
@@ -602,10 +602,8 @@ int verify_io_u_async(struct thread_data *td, struct io_u *io_u)
 	if (io_u->file)
 		put_file_log(td, io_u->file);
 
-	io_u->file = NULL;
-
 	pthread_mutex_lock(&td->io_u_lock);
-	
+
 	if (io_u->flags & IO_U_F_IN_CUR_DEPTH) {
 		td->cur_depth--;
 		io_u->flags &= ~IO_U_F_IN_CUR_DEPTH;