linux-kernel - Re: Yet another borken page_count() check in invalidate_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 15 Nov 2006 08:18:09 -0500
From:	Trond Myklebust <Trond.Myklebust@...app.com>
To:	Andrew Morton <akpm@...l.org>
Cc:	Charles Edward Lever <chucklever@...il.com>,
	linux-kernel@...r.kernel.org
Subject: Re: Yet another borken page_count() check in
	invalidate_inode_pages2()....

On Wed, 2006-11-15 at 00:33 -0500, Trond Myklebust wrote:
> I'm once again getting bogus errors from invalidate_inode_pages2() due
> to a VM bug. See the third line of remove_mapping().

Argh... Never try debugging past midnight: the above was a red herring.
I've been hitting the WARN_ON in invalidate_inode_pages2() reliably when
running NetApp's simulated i/o tool on the NFS client. It looks as if
I'm hitting a race in which writeback starts on the page after the call
to wait_on_page_writeback(), probably as a consequence of
unmap_mapping_range().

Anyhow, when we call try_to_release_page() with the GFP_WAIT argument,
it seems unnecessary that it should fail immediately if the page is
under writeback. How about something like the following patch?

Cheers,
 Trond
------------------------------------------------------------------
From: Trond Myklebust <Trond.Myklebust@...app.com>
Date: Wed, 15 Nov 2006 08:02:30 -0500
MM: Fix a loophole in try_to_release_page()

The following patch allows try_to_release_page() to wait on page writeback
instead of failing if the user specified __GFP_WAIT.

The reason is that when running NetApp's simulated I/O tool (sio_ntap) on
the NFS client, I can currently reliably trigger the WARN_ON() in
invalidate_inode_pages2().
Whereas we do wait on page_writeback in invalidate_inode_pages2_range(), we
do so before we unmap the page. There is still a race which will cause the
call to try_to_release_page() to fail the test for PageWriteback(page).

Signed-off-by: Trond Myklebust <Trond.Myklebust@...app.com>
---

 mm/filemap.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/mm/filemap.c b/mm/filemap.c
index 7b84dc8..d37f77b 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2445,7 +2445,9 @@ int try_to_release_page(struct page *pag
 	struct address_space * const mapping = page->mapping;

 	BUG_ON(!PageLocked(page));
-	if (PageWriteback(page))
+	if (gfp_mask & __GFP_WAIT)
+		wait_on_page_writeback(page);
+	else if (PageWriteback(page))
 		return 0;

 	if (mapping && mapping->a_ops->releasepage)
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/