Store the owning PID of each AIO context, so that resolved requests c…

…an access allocated memory in the guest.

This also slightly changes the AIO context ownership model: while it is still refcounted and retained by any pending requests, any context that does not have a valid task cannot resolve those requests. We flag such orphaned contexts, but allow the context to live until all pending requests have gotten the message and released the context.

fs/aio.c

@@ -30,7 +30,7 @@ static int _aioctx_table_ensure(struct aioctx_table *tbl, unsigned int newcap) {
     return 0;
 }
 
-struct aioctx *aioctx_new(int events_capacity) {
+struct aioctx *aioctx_new(int events_capacity, pid_t pid) {
     if ((INT_MAX / sizeof(struct aioctx_event)) < events_capacity) return NULL;
 
     struct aioctx *aioctx = malloc(sizeof(struct aioctx));
@@ -46,6 +46,8 @@ struct aioctx *aioctx_new(int events_capacity) {
 
     aioctx->events_capacity = events_capacity;
     aioctx->events = aioctx_events;
+    aioctx->is_owned_by_task = true;
+    aioctx->pid = pid;
 
     return aioctx;
 }
@@ -58,10 +60,7 @@ void aioctx_retain(struct aioctx *ctx) {
     unlock(&ctx->lock);
 }
 
-void aioctx_release(struct aioctx *ctx) {
-    if (ctx == NULL) return;
-
-    lock(&ctx->lock);
+static void _aioctx_decrement_ref(struct aioctx *ctx) {
     if (--ctx->refcount == 0) {
         free(ctx->events);
         free(ctx);
@@ -70,6 +69,21 @@ void aioctx_release(struct aioctx *ctx) {
     }
 }
 
+void aioctx_release(struct aioctx *ctx) {
+    if (ctx == NULL) return;
+
+    lock(&ctx->lock);
+    _aioctx_decrement_ref(ctx);
+}
+
+void aioctx_release_from_task(struct aioctx *ctx) {
+    if (ctx == NULL) return;
+
+    lock(&ctx->lock);
+    ctx->is_owned_by_task = false;
+    _aioctx_decrement_ref(ctx);
+}
+
 struct aioctx_table *aioctx_table_new(unsigned int capacity) {
     struct aioctx_table *tbl = malloc(sizeof(struct aioctx_table));
     if (tbl == NULL) return NULL;
@@ -90,7 +104,7 @@ void aioctx_table_delete(struct aioctx_table *tbl) {
     lock(&tbl->lock);
     for (int i = 0; i < tbl->capacity; i += 1) {
         if (tbl->contexts[i] != NULL) {
-            aioctx_release(tbl->contexts[i]);
+            aioctx_release_from_task(tbl->contexts[i]);
         }
     }
     free(tbl->contexts);
@@ -143,7 +157,7 @@ signed int aioctx_table_remove(struct aioctx_table *tbl, unsigned int ctx_id) {
         return _EINVAL;
     }
 
-    aioctx_release(ctx);
+    aioctx_release_from_task(ctx);
 
     unlock(&tbl->lock);
 

fs/aio.h

@@ -28,14 +28,24 @@ struct aioctx_event {
 struct aioctx {
     atomic_uint refcount;
     lock_t lock;
+
+    // Indicates if this context is owned by a task.
+    // 
+    // If true, then the `pid` field is guaranteed to be valid, and correspond
+    // to the task that made the request. If false, then the `pid` is invalid,
+    // and any pending or completed events should be treated as cancelled.
+    bool is_owned_by_task;
+
+    // The process that currently owns the context.
+    pid_t pid;
 
     // The capacity of the events structure.
     // 
     // This is specified by `io_setup`; requests that would potentially
     // overflow the events table should be rejected with `_EAGAIN`.
     dword_t events_capacity;
 
-    // The current table of pending events.
+    // The current table of pending and completed events.
     struct aioctx_event* events;
 };
 
@@ -71,10 +81,24 @@ signed int aioctx_table_insert(struct aioctx_table *tbl, struct aioctx *ctx);
 // Remove an AIO context from the table by it's position (context ID).
 // 
 // This returns an error code if the context ID is not valid for this table.
+// 
+// All pending I/O requests on the given context will retain the context until
+// they resolve. The context will also be flagged as having been released by
+// the task, which is treated as an implicit cancellation of any pending
+// requests.
 signed int aioctx_table_remove(struct aioctx_table *tbl, unsigned int ctx_id);
 
-struct aioctx *aioctx_new(int events_capacity);
+struct aioctx *aioctx_new(int events_capacity, pid_t pid);
 void aioctx_retain(struct aioctx *ctx);
 void aioctx_release(struct aioctx *ctx);
 
+// Release the AIO context and flag it as no longer being owned by a valid
+// task.
+// 
+// All pending I/O requests on the given context will retain the context until
+// they resolve. The context will also be flagged as having been released by
+// the task, which is treated as an implicit cancellation of any pending
+// requests.
+void aioctx_release_from_task(struct aioctx *ctx);
+
 #endif

kernel/aio.c

@@ -4,7 +4,7 @@
 #include "fs/aio.h"
 
 dword_t sys_io_setup(dword_t nr_events, addr_t ctx_idp) {
-    struct aioctx *ctx = aioctx_new(nr_events);
+    struct aioctx *ctx = aioctx_new(nr_events, current->pid);
     if (ctx == NULL) return _ENOMEM;
     if (IS_ERR(ctx)) return PTR_ERR(ctx);
 
@@ -24,7 +24,7 @@ dword_t sys_io_setup(dword_t nr_events, addr_t ctx_idp) {
 dword_t sys_io_destroy(addr_t p_ctx_id) {
     unsigned int ctx_id = 0;
     if (user_read(p_ctx_id, &ctx_id, sizeof(ctx_id))) return _EFAULT;
-    
+
     int err = aioctx_table_remove(current->aioctx, ctx_id) < 0;
     if (err < 0) {
         return err;