On 09/10/2020 15:35, Matthew Wilcox wrote: > On Fri, Oct 09, 2020 at 03:28:54PM +0300, Pavel Begunkov wrote: >> On 09/10/2020 15:12, Matthew Wilcox wrote: >>>> It seems this fails on "node->shift" in xas_next_entry(), that would >>>> mean that the node itself was freed while we're iterating on it. >>>> >>>> __io_uring_files_cancel() iterates with xas_next_entry() and creates >>>> XA_STATE once by hand, but it also removes entries in the loop with >>>> io_uring_del_task_file() -> xas_store(&xas, NULL); without updating >>>> the iterating XA_STATE. Could it be the problem? See a diff below >>> >>> No, the problem is that the lock is dropped after calling >>> xas_next_entry(), and at any point after calling xas_next_entry(), >>> the node that it's pointing to can be freed. >> >> Only the task itself clears/removes entries, others can only insert. >> So, could it be freed even though there are no parallel erases? > > Not with today's implementation, but that's something that might > change in the future. I agree it's probably the task itself that's > deleting the entry and causing the node to be deleted. I see, then it looks like I narrowed it down right. But your approach is cleaner anyway. -- Pavel Begunkov
