Bug 25617

Summary: aio_read crashes system.
Product: Base System Reporter: albowicz <albowicz>
Component: kernAssignee: Alan Cox <alc>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 4.2-STABLE   
Hardware: Any   
OS: Any   

Description albowicz 2001-03-08 20:40:01 UTC
Issuing two aio_reads for 131K blocks on a raw scsi device crashes the system.  Other block sizes do not crash the system.  Also using a normal file (e.g. "/tmp/foo.txt") does not crash the system.

How-To-Repeat: Run this program. as "a.out /dev/rda2"

#include <aio.h>
#include <errno.h>
#include <fcntl.h>
#include <stdlib.h>
#include <stdio.h>
#include <assert.h>
#include <unistd.h>
#include <string.h>


void do_aio_stuff(char * fname, int sector_size, int num_aiocbs)
{
  char buffs[num_aiocbs * sector_size];

  int fh = open(fname, O_RDONLY);
  assert(fh >= 0);
  
  aiocb iocbs[num_aiocbs];
  int cb_index;

  memset(iocbs, '\0', sizeof(aiocb) * num_aiocbs);

  for(cb_index = 0; cb_index < 2; cb_index++)
  {
      off_t pos = (long long) cb_index * sector_size +16384;
      
      iocbs[cb_index].aio_fildes = fh;
      iocbs[cb_index].aio_offset = pos;
      iocbs[cb_index].aio_buf = &buffs[cb_index*sector_size];
      iocbs[cb_index].aio_nbytes = sector_size;

      int ret_val = aio_read(&iocbs[cb_index]);
      if(ret_val == -1)
      {
          printf("aio_read error == %s\n", strerror(errno));
          exit(0);
      }
  }


  printf("Going to sleep\n");
  sleep(5);
  
  close(fh);
}


int main(int argc, char * argv[])
{
  char partition_name[1000];
  strcpy(partition_name, argv[1]);
  
  //int ss = 16384; // WORKS!!
  int ss = 131072;
  //int ss = 262144; // WORKS!!
  
  do_aio_stuff(partition_name, ss, 10);
  
  return 0;

}
Comment 1 dwmalone freebsd_committer freebsd_triage 2001-03-08 22:22:19 UTC
Responsible Changed
From-To: freebsd-bugs->alc

Alan has been looking at aio stuff recently (and less recently too! ;-)
Comment 2 Alan Cox freebsd_committer freebsd_triage 2001-03-18 21:00:50 UTC
State Changed
From-To: open->closed

This problem is fixed in revisions 1.97 and 1.70.2.9 of kern/vfs_aio.c. 
(The fix will appear in 4.3-RELEASE.)