On Thu, Aug 12, 2021 at 02:37:59PM +0100, David Howells wrote: > David Howells <dhowells@xxxxxxxxxx> wrote: > > > Matthew Wilcox <willy@xxxxxxxxxxxxx> wrote: > > > > > After submitting the IO here ... > > > > > > > + if (ret != -EIOCBQUEUED) > > > > + swapfile_read_complete(&ki->iocb, ret, 0); > > > > > > We only touch the 'ki' here ... if the caller didn't call read_complete > > > > > > > + swapfile_put_kiocb(ki); > > > > > > Except for here, which is only touched in order to put the refcount. > > > > > > So why can't swapfile_read_complete() do the work of freeing the ki? > > > > When I was doing something similar for cachefiles, I couldn't get it to work > > like that. I'll have another look at that. > > Ah, yes. generic_file_direct_write() accesses in the kiocb *after* calling > ->direct_IO(), so the kiocb *must not* go away until after > generic_file_direct_write() has returned. This is a read, not a write ... but we don't care about ki_pos being updated, so that store can be conditioned on IOCB_SWAP being clear. Or instead of storing directly to ki_pos, we take a pointer to ki_pos and then redirect that pointer somewhere harmless.
