Kernel Oops when calling aio_complete by workqueue

Question

Short Edition of the question:

Process submit IO through io_submit(file open with O_DIRECT). When kiocb->ki_complete(aio_complete_rw) is called in fs address_space_operations .direct_IO, everything works well. But when kiocb->ki_complete(aio_complete_rw) is called in workqueue work function(queued at the end of fs .direct_IO), kernel Oops happens.

---

I have modified code of a fs to receive request from libaio interfaces, fs would queue request to workqueue and return EIOCBQUEUED. Then the queued work would just call iocb->ki_complete, and kernel Oops happens.

[  161.904957] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[  161.905850] IP: async_read_work+0x246/0x2e0 
[  161.906425] PGD 0 P4D 0 
[  161.906693] Oops: 0000 [#1] SMP NOPTI
[  161.910190] CPU: 0 PID: 208 Comm: kworker/0:3 Tainted: G           OE    4.15.7 #1
[  161.912829] RIP: 0010:async_read_work+0x246/0x2e0
[  161.913454] RSP: 0018:ffffb3aac0657e28 EFLAGS: 00010282
[  161.913980] RAX: 000000000000000c RBX: ffff9bd0f682c720 RCX: 0000000000000006
[  161.914728] RDX: 0000000000000000 RSI: 0000000000000086 RDI: ffff9bd0ffc16650
[  161.915481] RBP: ffff9bd0f689cc00 R08: 0000000000000001 R09: 000000000000024f
[  161.916196] R10: ffffda7300da0b00 R11: 000000000000024f R12: 0000000000000002
[  161.916959] R13: 0000000000000001 R14: ffff9bd0f689cc00 R15: 0000000000000001
[  161.917720] FS:  0000000000000000(0000) GS:ffff9bd0ffc00000(0000) knlGS:0000000000000000
[  161.918566] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  161.919141] CR2: 0000000000000008 CR3: 000000002820a005 CR4: 00000000003606f0
[  161.919896] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  161.920648] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  161.921362] Call Trace:
[  161.921697]  process_one_work+0x147/0x3d0
[  161.922119]  worker_thread+0x4a/0x440
[  161.922540]  kthread+0xf8/0x130
[  161.922864]  ? process_one_work+0x3d0/0x3d0
[  161.923308]  ? kthread_associate_blkcg+0x90/0x90
[  161.923827]  ret_from_fork+0x35/0x40
[  161.924193] Code: 8b b8 58 04 00 00 48 83 c7 70 e8 d6 ee c6 e3 4c 89 f7 e8 9e e0 db e3 48 89 df e8 96 e0 db e3 48 c7 c7 f3 af 46 c0 e8 d4 e7 c7 e3 <48> 8b 3c 25 08 00 00 00 31 d2 be 64 00 00 00 48 8b 47 10 e8 62 
[  161.926145] RIP: async_read_work+0x246/0x2e0  RSP: ffffb3aac0657e28
[  161.926911] CR2: 0000000000000008
[  161.927257] ---[ end trace 1f9420e2f5786b43 ]---

I have tried call iocb->ki_complete in fs(before return EIOCBQUEUED) and it work well.

PS:I am trying to use workqueue to do memcpy request asynchronously, and memcpy request are passed through libaio interfaces and using libaio notification mechanism.

Here is the code:

struct async_work_stuct{
    struct iov_iter *a_iter;
    struct kiocb *a_iocb;
    int w_nr_segs;
    struct pinned_page *p;
    struct work_struct awork;
    struct task_struct *tsk;
};

struct pinned_page{
    struct page *pages[64];
    int num;
    int mapped;
};

Queue the work and return EIOCBQUEUED:

const struct address_space_operations aops_xip = {
  .direct_IO= my_direct_IO,
};
static ssize_t my_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
{
...
unsigned long nr_segs = iter->nr_segs;
struct pinned_page *pp = (struct pinned_page*)kzalloc(nr_segs*sizeof(struct pinned_page),GFP_KERNEL);
struct async_work_stuct *read_work = (struct async_work_stuct*)kzalloc(sizeof(struct async_work_stuct),GFP_KERNEL);

read_work->w_nr_segs = nr_segs;
read_work->p = pp;
read_work->a_iter = iter;
read_work->a_iocb = iocb;
read_work->tsk = current;

INIT_WORK(&(read_work->awork), async_read_work);

bak = queue_work(sb->s_dio_done_wq, &(read_work->awork));

ret = -EIOCBQUEUED; 
return ret;
}

Workqueue work function:

void async_read_work(struct work_struct *p_work)
{
    struct async_work_stuct *a_work = container_of(p_work, struct async_work_stuct, awork);
    struct pinned_page *pp = a_work->p;
    ...
    kfree(pp);
    pp = NULL;
    kfree(a_work);
    a_work = NULL;
    a_work->a_iocb->ki_complete(a_work->a_iocb,100, 0);
}

In my work function,I print the add of aio complete function,then kernel oops happen.

printk("aio_complete_addr = %u",a_work->a_iocb->ki_complete);

Is that means iocb is initialized wrong? My user process submits IO through io_submit,and here the aio complete function points to aio_complete_rw.

Answer 1

In your async_read_work function, you call kfree(a_work);, set a_work = NULL; and then dereference a_work here: a_work->a_iocb->ki_complete(a_work->a_iocb,100, 0);.

Possible solutions:

1. Rearrange the code:

       a_work->a_iocb->ki_complete(a_work->a_iocb,100, 0);
       kfree(a_work);
       a_work = NULL; /* not really necessary */
   

2. Use a local variable:

       struct kiocb *iocb;
       ...
       iocb = a_work->a_iocb;
       kfree(a_work);
       a_work = NULL; /* not really necessary */
       iocb->ki_complete(iocb,100, 0);