s3-aio-fork: Fix a segfault in vfs_aio_fork

aio_suspend does not signal the main process with a signal, it just waits. The
aio_fork module does not use the signal at all, it directly calls back into the
main smbd by calling smbd_aio_complete_aio_ex. This is an abstraction
violation, but the alternative would have been to use signals where they are
not needed. However, in wait_for_aio_completion this bites us: With aio_fork we
call handle_aio_completed twice on the same aio_ex struct: Once from the call
to handle_aio_completion within the aio_fork module and once from the code in
wait_for_aio_completion.

This patch fixes it in a pretty bad way by introducing flag variables and more
state. But the mid-term plan is to replace the posix aio calls from the vfs and
do pread_send/recv and pwrite_send/recv at the vfs layer, so this will
significantly change anyway.

Thanks to Kirill Malkin <kirill.malkin@starboardstorage.com> for reporting this
crash!

Autobuild-User: Volker Lendecke <vl@samba.org>
Autobuild-Date: Sat Mar 31 15:25:55 CEST 2012 on sn-devel-104

diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c
index 30d4b93ee7f27e814022c4fb7c136773e853cdfa..fa3db933a3956773c9e533157c7b43d9fa68c250 100644 (file)
--- a/source3/modules/vfs_aio_fork.c
+++ b/source3/modules/vfs_aio_fork.c
@@ -101,6 +101,8 @@ struct aio_child {
        bool dont_delete;       /* Marked as in use since last cleanup */
        bool cancelled;
        bool read_cmd;
+       bool called_from_suspend;
+       bool completion_done;
 };
 
 struct aio_child_list {
@@ -432,6 +434,10 @@ static void handle_aio_completion(struct event_context *event_ctx,
                       child->retval.size);
        }
 
+       if (child->called_from_suspend) {
+               child->completion_done = true;
+               return;
+       }
        aio_ex = (struct aio_extra *)child->aiocb->aio_sigevent.sigev_value.sival_ptr;
        smbd_aio_complete_aio_ex(aio_ex);
        TALLOC_FREE(aio_ex);
@@ -850,7 +856,9 @@ static int aio_fork_suspend(struct vfs_handle_struct *handle,
                                             handle_aio_completion,
                                             child);
 
-                       while (1) {
+                       child->called_from_suspend = true;
+
+                       while (!child->completion_done) {
                                if (tevent_loop_once(ev) == -1) {
                                        goto out;
                                }
@@ -859,12 +867,6 @@ static int aio_fork_suspend(struct vfs_handle_struct *handle,
                                        errno = EAGAIN;
                                        goto out;
                                }
-
-                               /* We set child->aiocb to NULL in our hooked
-                                * AIO_RETURN(). */
-                               if (child->aiocb == NULL) {
-                                       break;
-                               }
                        }
                }
        }