From patchwork Mon Apr 10 15:07:58 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Levin, Alexander" X-Patchwork-Id: 9672845 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0A6C860381 for ; Mon, 10 Apr 2017 15:22:48 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 14AB71FF28 for ; Mon, 10 Apr 2017 15:22:48 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0889E2838E; Mon, 10 Apr 2017 15:22:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 584BC28174 for ; Mon, 10 Apr 2017 15:22:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753896AbdDJPWi (ORCPT ); Mon, 10 Apr 2017 11:22:38 -0400 Received: from fldsmtpe01.verizon.com ([140.108.26.140]:41838 "EHLO fldsmtpe01.verizon.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753888AbdDJPWg (ORCPT ); Mon, 10 Apr 2017 11:22:36 -0400 X-Greylist: delayed 601 seconds by postgrey-1.27 at vger.kernel.org; Mon, 10 Apr 2017 11:22:35 EDT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=verizon.com; i=@verizon.com; q=dns/txt; s=corp; t=1491837756; x=1523373756; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=GNJPne38lhucp69zZqQTXAYitI9rL40mTee9K4q88FI=; b=S8PrMrf1+JZEdxYubx1QI4F/JNKHke2nzrTKXL/yQ+dqlAsZtoIaBiE0 KgADROJimx98oXTkj3JLFZ6KcH732jsN+gWBIKXDvC66GsgIVfL369FDv +VDC1Vb+YE3sh1EW/gYmi2mrlHYmeW77qoLoLmlqSElb5CO0lkzeZgOT7 o=; X-IronPort-Anti-Spam-Filtered: false Received: from unknown (HELO fldsmtpi01.verizon.com) ([166.68.71.143]) by fldsmtpe01.verizon.com with ESMTP; 10 Apr 2017 15:12:33 +0000 X-IronPort-AV: E=Sophos;i="5.37,182,1488844800"; d="scan'208";a="186661388" Received: from rogue-10-255-192-101.rogue.vzwcorp.com (HELO apollo.verizonwireless.com) ([10.255.192.101]) by fldsmtpi01.verizon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 10 Apr 2017 15:09:05 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=verizon.com; i=@verizon.com; q=dns/txt; s=corp; t=1491836945; x=1523372945; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=GNJPne38lhucp69zZqQTXAYitI9rL40mTee9K4q88FI=; b=PXBlENdkn7EhgA/IrJ50bhpB8/iUqh1e+h8D2/se/ryvH7OlwoMk0Xdo YFbqfnv2oloWTyMy0c20lS5VUUhN9YgQek88X8HmIppg5kTe4mL7o4cXZ btRWtrkdw3U2LzTeQPoDCUCLp6hJ39hRkLRhaLzuDpWXifcgnBePEfx0L o=; Received: from discovery.odc.vzwcorp.com (HELO mercury.verizonwireless.com) ([10.255.240.25]) by apollo.verizonwireless.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 10 Apr 2017 11:09:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=verizon.com; i=@verizon.com; q=dns/txt; s=corp; t=1491836944; x=1523372944; h=to:cc:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version:from; bh=GNJPne38lhucp69zZqQTXAYitI9rL40mTee9K4q88FI=; b=mmnvCHI1SqAioGWVnVmxLSoTpEdggJGP6mXntz9EC6clEbaLZnGJKG6c MKfHcS/pj4pYp2IkCpRzK2pFAxogrWtILD7hXihnus40tlfbV/UwZay+h 3iIexZrpV0OlcMJY0qQVpKEAiMrZ2+/lvAT7AjUiSCBwn/La13jbBVZZy 8=; From: alexander.levin@verizon.com X-Host: discovery.odc.vzwcorp.com Received: from nyora1hub002.uswin.ad.vzwcorp.com ([10.170.34.217]) by mercury.verizonwireless.com with ESMTP/TLS/AES256-SHA; 10 Apr 2017 15:08:08 +0000 Received: from OMZP1LUMXCA18.uswin.ad.vzwcorp.com (144.8.22.196) by NYORA1HUB002.uswin.ad.vzwcorp.com (10.170.34.217) with Microsoft SMTP Server (TLS) id 8.3.406.0; Mon, 10 Apr 2017 11:07:59 -0400 Received: from OMZP1LUMXCA17.uswin.ad.vzwcorp.com (144.8.22.195) by OMZP1LUMXCA18.uswin.ad.vzwcorp.com (144.8.22.196) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Mon, 10 Apr 2017 10:07:58 -0500 Received: from OMZP1LUMXCA17.uswin.ad.vzwcorp.com ([144.8.22.195]) by OMZP1LUMXCA17.uswin.ad.vzwcorp.com ([144.8.22.195]) with mapi id 15.00.1210.000; Mon, 10 Apr 2017 10:07:58 -0500 To: Jan Kara CC: Johannes Weiner , Andrew Morton , Tejun Heo , Hugh Dickins , Michel Lespinasse , "Kirill A. Shutemov" , "linux-mm@kvack.org" , "linux-fsdevel@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: Re: [patch 1/3] mm: protect set_page_dirty() from ongoing truncation Thread-Topic: [patch 1/3] mm: protect set_page_dirty() from ongoing truncation Thread-Index: AQHSsgw9f2vc0qBo1kq6JkonOL3+gA== Date: Mon, 10 Apr 2017 15:07:58 +0000 Message-ID: <20170410150755.kd2gjqyfmvschtxd@sasha-lappy> References: <1417791166-32226-1-git-send-email-hannes@cmpxchg.org> <20170410022230.xe5sukvflvoh4ula@sasha-lappy> <20170410120638.GD3224@quack2.suse.cz> In-Reply-To: <20170410120638.GD3224@quack2.suse.cz> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mutt/1.6.2-neo (2016-08-21) x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.144.60.250] Content-ID: <7C5DAAEEC8E1DC4D871FE18EF9EF3D30@vzwcorp.com> MIME-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Mon, Apr 10, 2017 at 02:06:38PM +0200, Jan Kara wrote: > On Mon 10-04-17 02:22:33, alexander.levin@verizon.com wrote: > > On Fri, Dec 05, 2014 at 09:52:44AM -0500, Johannes Weiner wrote: > > > Tejun, while reviewing the code, spotted the following race condition > > > between the dirtying and truncation of a page: > > > > > > __set_page_dirty_nobuffers() __delete_from_page_cache() > > > if (TestSetPageDirty(page)) > > > page->mapping = NULL > > > if (PageDirty()) > > > dec_zone_page_state(page, NR_FILE_DIRTY); > > > dec_bdi_stat(mapping->backing_dev_info, BDI_RECLAIMABLE); > > > if (page->mapping) > > > account_page_dirtied(page) > > > __inc_zone_page_state(page, NR_FILE_DIRTY); > > > __inc_bdi_stat(mapping->backing_dev_info, BDI_RECLAIMABLE); > > > > > > which results in an imbalance of NR_FILE_DIRTY and BDI_RECLAIMABLE. > > > > > > Dirtiers usually lock out truncation, either by holding the page lock > > > directly, or in case of zap_pte_range(), by pinning the mapcount with > > > the page table lock held. The notable exception to this rule, though, > > > is do_wp_page(), for which this race exists. However, do_wp_page() > > > already waits for a locked page to unlock before setting the dirty > > > bit, in order to prevent a race where clear_page_dirty() misses the > > > page bit in the presence of dirty ptes. Upgrade that wait to a fully > > > locked set_page_dirty() to also cover the situation explained above. > > > > > > Afterwards, the code in set_page_dirty() dealing with a truncation > > > race is no longer needed. Remove it. > > > > > > Reported-by: Tejun Heo > > > Signed-off-by: Johannes Weiner > > > Cc: > > > Acked-by: Kirill A. Shutemov > > > > Hi Johannes, > > > > I'm seeing the following while fuzzing with trinity on linux-next (I've changed > > the WARN to a VM_BUG_ON_PAGE for some extra page info). > > But this looks more like a bug in 9p which allows v9fs_write_end() to dirty > a !Uptodate page? I thought that 77469c3f5 ("9p: saner ->write_end() on failing copy into non-uptodate page") prevented from that happening, but that's actually the change that's causing it (I ended up misreading it last night). Will fix it as follows: diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c index adaf6f6..be84c0c 100644 --- a/fs/9p/vfs_addr.c +++ b/fs/9p/vfs_addr.c @@ -310,9 +310,13 @@ static int v9fs_write_end(struct file *filp, struct address_space *mapping, p9_debug(P9_DEBUG_VFS, "filp %p, mapping %p\n", filp, mapping); - if (unlikely(copied < len && !PageUptodate(page))) { - copied = 0; - goto out; + if (!PageUptodate(page)) { + if (unlikely(copied < len)) { + copied = 0; + goto out; + } else { + SetPageUptodate(page); + } } /* * No need to use i_size_read() here, the i_size