From owner-freebsd-current@FreeBSD.ORG  Sun Apr  4 13:17:46 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 355F516A4CF
	for <current@freebsd.org>; Sun,  4 Apr 2004 13:17:46 -0700 (PDT)
Received: from critter.freebsd.dk (0x50a171c6.naenxx7.adsl-dhcp.tele.dk
	[80.161.113.198])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4666543D48
	for <current@freebsd.org>; Sun,  4 Apr 2004 13:17:45 -0700 (PDT)
	(envelope-from phk@phk.freebsd.dk)
Received: from critter.freebsd.dk (localhost [127.0.0.1])
	by critter.freebsd.dk (8.12.11/8.12.11) with ESMTP id i34KHMeC001840;
	Sun, 4 Apr 2004 22:17:23 +0200 (CEST)
	(envelope-from phk@phk.freebsd.dk)
To: Doug Ambrisko <ambrisko@ambrisko.com>
From: "Poul-Henning Kamp" <phk@phk.freebsd.dk>
In-Reply-To: Your message of "Sun, 04 Apr 2004 13:02:49 PDT."
             <200404042002.i34K2nop038808@ambrisko.com> 
Date: Sun, 04 Apr 2004 22:17:22 +0200
Message-ID: <1839.1081109842@critter.freebsd.dk>
cc: current@freebsd.org
cc: =?ISO-8859-1?Q?S=F8ren_Schmidt?= <sos@DeepCore.dk>
Subject: Re: Intel SATA ICH5/5R 6300ESB support patches 
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 04 Apr 2004 20:17:46 -0000

In message <200404042002.i34K2nop038808@ambrisko.com>, Doug Ambrisko writes:
>Søren Schmidt writes:

>| > I put in a patch for geom for bio_taskqueue_remove.  Since ata code
>| > schedules bio_task it need to be cancelled when we abort and call
>| > biodone.  If we don't cancel this task then when the task is 
>| > run later we get a double free in UMA since we have cleaned up
>| > twice and called biodone twice for the same request.

Sos@ forwarded that patch and it won't fly, it has no chance of
working reliably on multi-cpu machines:

There is no guarantee that the task is still on the queue by the
time you try to remove it, and if is not, it is likely to be because
another CPU is already waiting for a lock in the ata driver in the
bio_taskqueue handler function, so we have no way to cancel that
other CPU's activity.

The correct solution is to not do the biodone when you cancel, but
let the already scheduled bio_taskqueue event to do so.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.