From: Benjamin LaHaise <bcrl@kvack.org>

Implement a per-kiocb lock to serialise retry operations and cancel.  This
is done using wait_on_bit_lock() on the KIF_LOCKED bit of kiocb->ki_flags. 
Also, make the cancellation path lock the kiocb and subsequently release
all references to it if the cancel was successful.

Signed-off-by: Benjamin LaHaise <benjamin.c.lahaise@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 fs/aio.c |   23 +++++++++++++++++++++++
 1 files changed, 23 insertions(+)

diff -puN fs/aio.c~aio-kiocb-locking-to-serialise-retry-and-cancel fs/aio.c
--- devel/fs/aio.c~aio-kiocb-locking-to-serialise-retry-and-cancel	2005-08-21 23:48:35.000000000 -0700
+++ devel-akpm/fs/aio.c	2005-08-21 23:48:35.000000000 -0700
@@ -546,6 +546,24 @@ struct kioctx *lookup_ioctx(unsigned lon
 	return ioctx;
 }
 
+static int lock_kiocb_action(void *param)
+{
+	schedule();
+	return 0;
+}
+
+static inline void lock_kiocb(struct kiocb *iocb)
+{
+	wait_on_bit_lock(&iocb->ki_flags, KIF_LOCKED, lock_kiocb_action,
+			 TASK_UNINTERRUPTIBLE);
+}
+
+static inline void unlock_kiocb(struct kiocb *iocb)
+{
+	kiocbClearLocked(iocb);
+	wake_up_bit(&iocb->ki_flags, KIF_LOCKED);
+}
+
 /*
  * use_mm
  *	Makes the calling kernel thread take on the specified
@@ -786,7 +804,9 @@ static int __aio_run_iocbs(struct kioctx
 		 * Hold an extra reference while retrying i/o.
 		 */
 		iocb->ki_users++;       /* grab extra reference */
+		lock_kiocb(iocb);
 		aio_run_iocb(iocb);
+		unlock_kiocb(iocb);
 		if (__aio_put_req(ctx, iocb))  /* drop extra ref */
 			put_ioctx(ctx);
  	}
@@ -1536,6 +1556,7 @@ int fastcall io_submit_one(struct kioctx
 			;
 	}
 	spin_unlock_irq(&ctx->ctx_lock);
+	unlock_kiocb(req);
 	aio_put_req(req);	/* drop extra ref to req */
 	return 0;
 
@@ -1661,6 +1682,7 @@ asmlinkage long sys_io_cancel(aio_contex
 	if (NULL != cancel) {
 		struct io_event tmp;
 		pr_debug("calling cancel\n");
+		lock_kiocb(kiocb);
 		memset(&tmp, 0, sizeof(tmp));
 		tmp.obj = (u64)(unsigned long)kiocb->ki_obj.user;
 		tmp.data = kiocb->ki_user_data;
@@ -1672,6 +1694,7 @@ asmlinkage long sys_io_cancel(aio_contex
 			if (copy_to_user(result, &tmp, sizeof(tmp)))
 				ret = -EFAULT;
 		}
+		unlock_kiocb(kiocb);
 	} else
 		ret = -ENOSYS;
 
_