lkml.org 
[lkml]   [2012]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 45/83] tmpfs: fix shmem_getpage_gfp() VM_BUG_ON
    Date
    3.6-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Hugh Dickins <hughd@google.com>

    commit 215c02bc33bbd5ff4d7379a909462d11f0103218 upstream.

    Fuzzing with trinity hit the "impossible" VM_BUG_ON(error) (which Fedora
    has converted to WARNING) in shmem_getpage_gfp():

    WARNING: at mm/shmem.c:1151 shmem_getpage_gfp+0xa5c/0xa70()
    Pid: 29795, comm: trinity-child4 Not tainted 3.7.0-rc2+ #49
    Call Trace:
    warn_slowpath_common+0x7f/0xc0
    warn_slowpath_null+0x1a/0x20
    shmem_getpage_gfp+0xa5c/0xa70
    shmem_fault+0x4f/0xa0
    __do_fault+0x71/0x5c0
    handle_pte_fault+0x97/0xae0
    handle_mm_fault+0x289/0x350
    __do_page_fault+0x18e/0x530
    do_page_fault+0x2b/0x50
    page_fault+0x28/0x30
    tracesys+0xe1/0xe6

    Thanks to Johannes for pointing to truncation: free_swap_and_cache()
    only does a trylock on the page, so the page lock we've held since
    before confirming swap is not enough to protect against truncation.

    What cleanup is needed in this case? Just delete_from_swap_cache(),
    which takes care of the memcg uncharge.

    Signed-off-by: Hugh Dickins <hughd@google.com>
    Reported-by: Dave Jones <davej@redhat.com>
    Cc: Johannes Weiner <hannes@cmpxchg.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    mm/shmem.c | 16 ++++++++++++++--
    1 file changed, 14 insertions(+), 2 deletions(-)

    --- a/mm/shmem.c
    +++ b/mm/shmem.c
    @@ -1156,8 +1156,20 @@ repeat:
    if (!error) {
    error = shmem_add_to_page_cache(page, mapping, index,
    gfp, swp_to_radix_entry(swap));
    - /* We already confirmed swap, and make no allocation */
    - VM_BUG_ON(error);
    + /*
    + * We already confirmed swap under page lock, and make
    + * no memory allocation here, so usually no possibility
    + * of error; but free_swap_and_cache() only trylocks a
    + * page, so it is just possible that the entry has been
    + * truncated or holepunched since swap was confirmed.
    + * shmem_undo_range() will have done some of the
    + * unaccounting, now delete_from_swap_cache() will do
    + * the rest (including mem_cgroup_uncharge_swapcache).
    + * Reset swap.val? No, leave it so "failed" goes back to
    + * "repeat": reading a hole and writing should succeed.
    + */
    + if (error)
    + delete_from_swap_cache(page);
    }
    if (error)
    goto failed;



    \
     
     \ /
      Last update: 2012-11-24 03:21    [W:4.077 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site