On Wed, Mar 6, 2019 at 4:03 PM Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
>
> From: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
>
> "aio: remove the extra get_file/fput pair in io_submit_one" was
> too optimistic - not dereferencing file pointer after e.g.
> ->write_iter() returns is not enough; that reference might've been
> the only thing that kept alive objects that are referenced
> *before* the method returns. Such as inode, for example...
I still; think that this is actually _worse_ than just having the
refcount on the req instead.
As it is, we have that completely insane "ref can go away from under
us", because nothing keeps that around, which then causes all those
other crazy issues with "woken" etc garbage.
I think we should be able to get rid of those entirely. Make the
poll() case just return zero if it has added the entry successfully to
poll queue. No need for "woken", no need for all that odd "oh, but
now the req might no longer exist".
The refcount wasn't the problem. Everything *else* was the problem,
including only using the refcount for the poll case etc.
Linus
