aio: fix memory corruption in aio-last-ref-held-by-io

This's been detected by testing generic/323 on btrfs, it keeps
producing chaos of checksum errors.

It is because aio-last-ref-held-by-io uses a static buffer that is
been used repeatedly for every io_submit() call, but we'll issue
NUM_IOS(=16) io_sumbit() in a 'for' loop at a time, and when those
data read by aio has not finish its endio(), its memory is likely to
be used in the next io_submit, which ends up data corruption and
numerous checksum errors.

This allocates memory for each io_submit() and generic/323 runs fine
after this.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>

diff --git a/src/aio-dio-regress/aio-last-ref-held-by-io.c b/src/aio-dio-regress/aio-last-ref-held-by-io.c
index a73dc3bd48d6fd33081cb871dedecd1121e8bb73..7633831e10231e5ad57607f8e1f4012625444d90 100644 (file)
--- a/src/aio-dio-regress/aio-last-ref-held-by-io.c
+++ b/src/aio-dio-regress/aio-last-ref-held-by-io.c
@@ -109,7 +109,7 @@ aio_test_thread(void *data)
        ioctx_initted = 0;
        ios_submitted = 0;
 
-       ret = posix_memalign((void **)&buffer, getpagesize(), IOSIZE);
+       ret = posix_memalign((void **)&buffer, getpagesize(), IOSIZE * NUM_IOS);
        if (ret != 0) {
                printf("%lu: Failed to allocate buffer for IO: %d\n",
                       pthread_self(), ret);
@@ -137,7 +137,7 @@ aio_test_thread(void *data)
                                struct iocb *iocb = &iocbs[i];
 
                                memset(iocb, 0, sizeof(*iocb));
-                               io_prep_pread(iocb, fd, buffer,
+                               io_prep_pread(iocb, fd, (buffer + i * IOSIZE),
                                              IOSIZE, i * IOSIZE);
                                if (io_submit(ioctx, 1, &iocb) != 1) {
                                        printf("%lu: failed to submit io #%d\n",