Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-10-02 19:58:01 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
nuttx/fs/aio/lio_listio.c
Xiang Xiao 74d2c2d119 fs/aio: use list_clear_node() to mark non-batch requests 
aio_fsync()/aio_read()/aio_write()/lio_listio() initialized
aiocbp->lio_link with list_initialize(), which makes the node
self-referential (prev = next = &node).  aio_signal() tests
list_in_list(&lio_link) to detect lio_listio batches, so it wrongly
entered the lio_listio completion path for every standalone AIO
operation and notified through the uninitialized
lio_sigevent/lio_sigwork.

With CONFIG_SIG_EVTHREAD=y, garbage lio_sigevent.sigev_notify ==
SIGEV_THREAD caused nxsig_notification() to queue &lio_sigwork.work
onto the low-priority work queue with garbage func/value.  After the
aiocb was freed, the dangling work_s was dispatched with worker=NULL,
crashing in work_dispatch().

Fix: initialize lio_link with list_clear_node() (prev = next = NULL)
so list_in_list() returns false for non-lio_listio operations and
aio_signal() skips the lio_listio path.

While there, reject a NULL aiocbp in aio_fsync(): POSIX Issue 6 no
longer defines a NULL special case, and the old DEBUGASSERT() panicked
debug builds.

Co-developed-by: dengwenqi <dengwenqi@xiaomi.com>
Co-developed-by: fangxinyong <fangxinyong@xiaomi.com>
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Signed-off-by: dengwenqi <dengwenqi@xiaomi.com>
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
2026-09-14 17:12:49 -03:00

567 lines
18 KiB
C
Raw Blame History

/****************************************************************************
* fs/aio/lio_listio.c
*
* SPDX-License-Identifier: Apache-2.0
*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership. The
* ASF licenses this file to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance with the
* License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
* License for the specific language governing permissions and limitations
* under the License.
*
****************************************************************************/
/****************************************************************************
* Included Files
****************************************************************************/
#include <nuttx/config.h>
#include <unistd.h>
#include <signal.h>
#include <aio.h>
#include <assert.h>
#include <nuttx/debug.h>
#include <errno.h>
#include <nuttx/signal.h>
#include <nuttx/sched.h>
#include "aio/aio.h"
#ifdef CONFIG_FS_AIO
/****************************************************************************
* Private Functions
****************************************************************************/
/****************************************************************************
* Name: lio_checkio
*
* Description:
* Check if all I/O operations in the list are complete.
*
* Input Parameters:
* list - The list of I/O operations to be performed
* nent - The number of elements in the list
*
* Returned Value:
* Zero (OK) is returned if all I/O completed successfully.
* -EINPROGRESS is returned if one or more I/Os have not yet completed.
* The negated errno value if first error noted in the case where all I/O
* completed but one or more I/Os completed with an error.
*
* Assumptions:
* The scheduler is locked and no I/O can complete asynchronously with
* the logic in this function.
*
****************************************************************************/
static int lio_checkio(FAR struct aiocb *restrict const *restrict list,
int nent)
{
FAR struct aiocb *aiocbp;
int ret;
int i;
ret = OK; /* Assume success */
/* Check each entry in the list. Break out of the loop if any entry
* has not completed.
*/
for (i = 0; i < nent; i++)
{
/* Skip over NULL entries */
aiocbp = list[i];
if (aiocbp)
{
/* Check if the I/O has completed */
if (aiocbp->aio_result == -EINPROGRESS)
{
/* No.. return -EINPROGRESS */
return -EINPROGRESS;
}
/* Check for an I/O error */
else if (aiocbp->aio_result < 0 && ret == OK)
{
/* Some other error other than -EINPROGRESS */
ret = aiocbp->aio_result;
}
}
}
/* All of the I/Os have completed */
return ret;
}
/****************************************************************************
* Name: lio_waitall
*
* Description:
* Wait for all I/O operations in the list to be complete.
*
* Input Parameters:
* list - The list of I/O operations to be performed
* nent - The number of elements in the list
*
* Returned Value:
* Zero (OK) is returned if all I/O completed successfully; Otherwise, a
* negated errno value is returned corresponding to the first error
* detected.
*
* Assumptions:
* The scheduler is locked and no I/O can complete asynchronously with
* the logic in this function.
*
****************************************************************************/
static int lio_waitall(FAR struct aiocb *restrict const *restrict list,
int nent)
{
sigset_t set;
int ret;
/* Loop until all I/O completes */
for (; ; )
{
/* Check if all I/O has completed */
ret = lio_checkio(list, nent);
if (ret != -EINPROGRESS)
{
/* All I/O has completed.. We are finished. */
return ret;
}
/* Then wait for SIGPOLL -- indefinitely.
*
* NOTE: If completion of the I/O causes other signals to be generated
* first, then this will wake up and return EINTR instead of success.
*/
sigemptyset(&set);
sigaddset(&set, SIGPOLL);
ret = sigwaitinfo(&set, NULL);
if (ret < 0)
{
int errcode = get_errno();
/* The most likely reason that we would get here is because some
* unrelated signal has been received.
*/
ferr("ERROR: sigwaitinfo failed: %d\n", errcode);
DEBUGASSERT(errcode > 0);
return -errcode;
}
}
}
/****************************************************************************
* Public Functions
****************************************************************************/
/****************************************************************************
* Name: lio_listio
*
* Description:
* The lio_listio() function initiates a list of I/O requests with a
* single function call.
*
* The 'mode' argument takes one of the values LIO_WAIT or LIO_NOWAIT
* declared in <aio.h> and determines whether the function returns when
* the I/O operations have been completed, or as soon as the operations
* have been queued. If the 'mode' argument is LIO_WAIT, the function will
* wait until all I/O is complete and the 'sig' argument will be ignored.
*
* If the 'mode' argument is LIO_NOWAIT, the function will return
* immediately, and asynchronous notification will occur, according to the
* 'sig' argument, when all the I/O operations complete. If 'sig' is NULL,
* then no asynchronous notification will occur. If 'sig' is not NULL,
* asynchronous notification occurs when all the requests in 'list' have
* completed.
*
* The I/O requests enumerated by 'list' are submitted in an unspecified
* order.
*
* The 'list' argument is an array of pointers to aiocb structures. The
* array contains 'nent 'elements. The array may contain NULL elements,
* which will be ignored.
*
* If the buffer pointed to by 'list' or the aiocb structures pointed to
* by the elements of the array 'list' become illegal addresses before all
* asynchronous I/O completed and, if necessary, the notification is
* sent, then the behavior is undefined. If the buffers pointed to by the
* aio_buf member of the aiocb structure pointed to by the elements of
* the array 'list' become illegal addresses prior to the asynchronous
* I/O associated with that aiocb structure being completed, the behavior
* is undefined.
*
* The aio_lio_opcode field of each aiocb structure specifies the
* operation to be performed. The supported operations are LIO_READ,
* LIO_WRITE, and LIO_NOP; these symbols are defined in <aio.h>. The
* LIO_NOP operation causes the list entry to be ignored. If the
* aio_lio_opcode element is equal to LIO_READ, then an I/O operation is
* submitted as if by a call to aio_read() with the aiocbp equal to the
* address of the aiocb structure. If the aio_lio_opcode element is equal
* to LIO_WRITE, then an I/O operation is submitted as if by a call to
* aio_write() with the aiocbp equal to the address of the aiocb
* structure.
*
* The aio_fildes member specifies the file descriptor on which the
* operation is to be performed.
*
* The aio_buf member specifies the address of the buffer to or from which
* the data is transferred.
*
* The aio_nbytes member specifies the number of bytes of data to be
* transferred.
*
* The members of the aiocb structure further describe the I/O operation
* to be performed, in a manner identical to that of the corresponding
* aiocb structure when used by the aio_read() and aio_write() functions.
*
* The 'nent' argument specifies how many elements are members of the list;
* that is, the length of the array.
*
* Input Parameters:
* mode - Either LIO_WAIT or LIO_NOWAIT
* list - The list of I/O operations to be performed
* nent - The number of elements in the list
* sig - Used to notify the caller when the I/O is performed
* asynchronously.
*
* Returned Value:
* If the mode argument has the value LIO_NOWAIT, the lio_listio()
* function will return the value zero if the I/O operations are
* successfully queued; otherwise, the function will return the value
* -1 and set errno to indicate the error.
*
* If the mode argument has the value LIO_WAIT, the lio_listio() function
* will return the value zero when all the indicated I/O has completed
* successfully. Otherwise, lio_listio() will return a value of -1 and
* set errno to indicate the error.
*
* In either case, the return value only indicates the success or failure
* of the lio_listio() call itself, not the status of the individual I/O
* requests. In some cases one or more of the I/O requests contained in
* the list may fail. Failure of an individual request does not prevent
* completion of any other individual request. To determine the outcome
* of each I/O request, the application must examine the error status
* associated with each aiocb control block. The error statuses so
* returned are identical to those returned as the result of an aio_read()
* or aio_write() function.
*
* The lio_listio() function will fail if:
*
* EAGAIN - The resources necessary to queue all the I/O requests were
* not available. The application may check the error status for each
* aiocb to determine the individual request(s) that failed.
* EAGAIN - The number of entries indicated by 'nent' would cause the
* system-wide limit {AIO_MAX} to be exceeded.
* EINVAL - The mode argument is not a proper value, or the value of
* 'nent' was greater than {AIO_LISTIO_MAX}.
* EINTR - A signal was delivered while waiting for all I/O requests to
* complete during an LIO_WAIT operation. Note that, since each I/O
* operation invoked by lio_listio() may possibly provoke a signal when
* it completes, this error return may be caused by the completion of
* one (or more) of the very I/O operations being awaited. Outstanding
* I/O requests are not cancelled, and the application will examine
* each list element to determine whether the request was initiated,
* cancelled, or completed.
* EIO - One or more of the individual I/O operations failed. The
* application may check the error status for each aiocb structure to
* determine the individual request(s) that failed.
*
* In addition to the errors returned by the lio_listio() function, if the
* lio_listio() function succeeds or fails with errors of EAGAIN, EINTR, or
* EIO, then some of the I/O specified by the list may have been initiated.
* If the lio_listio() function fails with an error code other than EAGAIN,
* EINTR, or EIO, no operations from the list will have been initiated. The
* I/O operation indicated by each list element can encounter errors
* specific to the individual read or write function being performed. In
* this event, the error status for each aiocb control block contains the
* associated error code. The error codes that can be set are the same as
* would be set by a read() or write() function, with the following
* additional error codes possible:
*
* EAGAIN - The requested I/O operation was not queued due to resource
* limitations.
* ECANCELED - The requested I/O was cancelled before the I/O completed
* due to an explicit aio_cancel() request.
* EFBIG - The aiocbp->aio_lio_opcode is LIO_WRITE, the file is a
* regular file, aiocbp->aio_nbytes is greater than 0, and the
* aiocbp->aio_offset is greater than or equal to the offset maximum
* in the open file description associated with aiocbp->aio_fildes.
* EINPROGRESS - The requested I/O is in progress.
* EOVERFLOW - The aiocbp->aio_lio_opcode is LIO_READ, the file is a
* regular file, aiocbp->aio_nbytes is greater than 0, and the
* aiocbp->aio_offset is before the end-of-file and is greater than
* or equal to the offset maximum in the open file description
* associated with aiocbp->aio_fildes.
*
****************************************************************************/
int lio_listio(int mode, FAR struct aiocb *restrict const list[restrict],
int nent, FAR struct sigevent *restrict sig)
{
FAR struct aiocb *aiocbp = NULL;
struct list_node head;
int nqueued;
int errcode;
int retcode;
int status;
int ret;
int i;
if (nent < 0 || nent > AIO_LISTIO_MAX ||
(mode != LIO_WAIT && mode != LIO_NOWAIT))
{
set_errno(EINVAL);
return ERROR;
}
DEBUGASSERT(list);
nqueued = 0; /* No I/O operations yet queued */
ret = OK; /* Assume success */
if (mode == LIO_NOWAIT && sig)
{
list_initialize(&head);
}
for (i = 0; i < nent; i++)
{
aiocbp = list[i];
if (aiocbp && aiocbp->aio_lio_opcode != LIO_NOP)
{
if (mode == LIO_NOWAIT && sig)
{
list_add_head(&head, &(aiocbp->lio_link));
aiocbp->lio_sigevent = *sig;
}
else
{
/* Not part of a lio_listio batch: clear lio_link so that
* aio_signal() skips the lio_listio completion path.
*/
list_clear_node(&aiocbp->lio_link);
}
}
}
/* Submit each asynchronous I/O operation in the list, skipping over NULL
* entries.
*/
for (i = 0; i < nent; i++)
{
/* Skip over NULL entries */
aiocbp = list[i];
if (!aiocbp)
{
continue;
}
/* Submit the operation according to its opcode */
status = OK;
switch (aiocbp->aio_lio_opcode)
{
case LIO_NOP:
{
/* Mark the do-nothing operation complete */
aiocbp->aio_result = OK;
}
break;
case LIO_READ:
case LIO_WRITE:
{
if (aiocbp->aio_lio_opcode == LIO_READ)
{
/* Submit the asynchronous read operation */
status = aio_read_internal(aiocbp);
}
else
{
/* Submit the asynchronous write operation */
status = aio_write_internal(aiocbp);
}
if (status < 0)
{
/* Failed to queue the I/O. Set up the error return. */
errcode = get_errno();
ferr("ERROR: aio_read/write failed: %d\n", errcode);
DEBUGASSERT(errcode > 0);
aiocbp->aio_result = -errcode;
ret = ERROR;
}
if (status < 0 || aiocbp->aio_result == -EBADF ||
aiocbp->aio_result == -EINVAL)
{
if (mode == LIO_NOWAIT && sig)
{
aio_lock();
list_delete(&aiocbp->lio_link);
aio_unlock();
}
}
else
{
/* Increment the count of successfully queue operations */
nqueued++;
}
}
break;
default:
{
/* Make the invalid operation complete with an error */
ferr("ERROR: Unrecognized opcode: %d\n",
aiocbp->aio_lio_opcode);
aiocbp->aio_result = -EINVAL;
ret = ERROR;
}
break;
}
}
/* If there was any failure in queuing the I/O, EIO will be returned */
retcode = EIO;
/* Now what? Three possibilities:
*
* Case 1: mode == LIO_WAIT
*
* Ignore the sig argument; Do no return until all I/O completes.
*/
if (mode == LIO_WAIT)
{
/* Don't wait if all if no I/O was queue */
if (nqueued > 0)
{
/* Wait until all I/O completes. The scheduler will be unlocked
* while we are waiting.
*/
status = lio_waitall(list, nent);
if (status < 0 && ret == OK)
{
/* Something bad happened while waiting and this is the first
* error to be reported.
*/
retcode = -status;
ret = ERROR;
}
}
}
/* Case 2: mode == LIO_NOWAIT and sig != NULL
*
* If any I/O was queued, then setup to signal the caller when all of
* the transfers complete.
*
* If no I/O was queue, then we I suppose that we need to signal the
* caller ourself?
*/
else if (sig != NULL)
{
aio_lock();
status = list_is_empty(&head);
list_delete(&head);
aio_unlock();
if (status)
{
/* head is empty meaning all I/O completed before head was
* removed, so manually signal the client
*/
/* Find a non-NULL aiocbp */
if (aiocbp == NULL)
{
for (i = 0; i < nent; i++)
{
if (list[i])
{
aiocbp = list[i];
break;
}
}
if (aiocbp == NULL)
{
goto out;
}
}
status = nxsig_notification(nxsched_getpid(),
&aiocbp->lio_sigevent,
SI_ASYNCIO,
&aiocbp->lio_sigwork);
if (status < 0 && ret == OK)
{
/* Something bad happened while signal the client and
* this is the first error to be reported.
*/
retcode = -status;
ret = ERROR;
}
}
}
/* Case 3: mode == LIO_NOWAIT and sig == NULL
*
* Just return now.
*/
out:
if (ret < 0)
{
set_errno(retcode);
return ERROR;
}
return OK;
}
#endif /* CONFIG_FS_AIO */
Reference in a new issue View git blame Copy permalink