David Howells <dhowells@xxxxxxxxxx> wrote: > Matthew Wilcox <willy@xxxxxxxxxxxxx> wrote: > > > After submitting the IO here ... > > > > > + if (ret != -EIOCBQUEUED) > > > + swapfile_read_complete(&ki->iocb, ret, 0); > > > > We only touch the 'ki' here ... if the caller didn't call read_complete > > > > > + swapfile_put_kiocb(ki); > > > > Except for here, which is only touched in order to put the refcount. > > > > So why can't swapfile_read_complete() do the work of freeing the ki? > > When I was doing something similar for cachefiles, I couldn't get it to work > like that. I'll have another look at that. Ah, yes. generic_file_direct_write() accesses in the kiocb *after* calling ->direct_IO(), so the kiocb *must not* go away until after generic_file_direct_write() has returned. David
