Zach and I found a nasty race condition with the sets: we were

overloading the refcount to mean both "number of outstanding I/Os" and
also "number of threads using this structure".  It was possible in
extreme circumstances to free the set in the reading thread before the
event handling thread called wake_up, which would thus crash.

To address this, there is a new count (brw_desc_count), which counts
the number of remaining I/Os.  The other count, brw_refcount, now
properly tracks users of the structure to prevent early freeing.

diff --git a/lustre/llite/iod.c b/lustre/llite/iod.c
index 4a2b59b..e670fb1 100644 (file)
--- a/lustre/llite/iod.c
+++ b/lustre/llite/iod.c
@@ -209,7 +209,7 @@ static void ll_brw_pages_unlock( struct inode *inode,
                 if (rc)
                         CERROR("error from callback: rc = %d\n", rc);
         }
-        obd_brw_set_free(set);
+        obd_brw_set_decref(set);
 
         /* XXX this doesn't make sense to me */
         rc = 0;