lkml.org 
[lkml]   [2020]   [Jun]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Re: [fuse] 6b2fb79963: WARNING:at_fs/fuse/file.c:#tree_insert[fuse]
    From
    Date
    Hi,

    On 16.06.2020 15:35, Miklos Szeredi wrote:
    > On Mon, Jun 15, 2020 at 7:59 AM Vasily Averin <vvs@virtuozzo.com> wrote:
    >>
    >> On 6/15/20 3:50 AM, kernel test robot wrote:
    >>> FYI, we noticed the following commit (built with gcc-9):
    >>>
    >>> commit: 6b2fb79963fbed7db3ef850926d913518fd5c62f ("fuse: optimize writepages search")
    >>> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
    >>
    >>> [ 1030.995703] ------------[ cut here ]------------
    >>> [ 1030.997563] WARNING: CPU: 1 PID: 17211 at fs/fuse/file.c:1728 tree_insert+0xab/0xc0 [fuse]
    >>> [ 1031.021943] RIP: 0010:tree_insert+0xab/0xc0 [fuse]
    >>> [ 1031.057802] Call Trace:
    >>> [ 1031.060015] fuse_writepages_fill+0x5da/0x6a0 [fuse]
    >>> [ 1031.062536] write_cache_pages+0x171/0x470
    >>> [ 1031.064933] ? fuse_writepages+0x100/0x100 [fuse]
    >>> [ 1031.067419] ? terminate_walk+0xd3/0xf0
    >>> [ 1031.069707] ? _cond_resched+0x19/0x30
    >>> [ 1031.072140] ? __kmalloc+0x274/0x280
    >>> [ 1031.074407] fuse_writepages+0x8a/0x100 [fuse]
    >>> [ 1031.076599] do_writepages+0x43/0xe0
    >>
    >> It is WARN_ON(!wpa->ia.ap.num_pages);
    >> however tree_insert() was called from fuse_writepages_fill() with ap->num_pages = 0;
    >> In submitted PATCH RFC we have used
    >>
    >> +static int tree_insert(struct rb_root *root, struct fuse_req *ins_req)
    >> ...
    >> + pgoff_t idx_to = idx_from + (ins_req->num_pages ?
    >> + ins_req->num_pages - 1 : 0);
    >>
    >> Though committed patch version have
    >>
    >> +static void tree_insert(struct rb_root *root, struct fuse_writepage_args *wpa)
    >> ...
    >> + pgoff_t idx_to = idx_from + wpa->ia.ap.num_pages - 1;
    >> ...
    >> + WARN_ON(!wpa->ia.ap.num_pages);
    >>
    >> Miklos,
    >> do you have any objections if I return to our initial proposal?
    >> Am I missed something and it is not allowed now?
    >
    > No objections, but you need to explain with a comment why that special
    > casing of num_pages == 0 is needed. I don't understand it yet.

    Currently here is already a bomb in mainline kernel.

    This fuse_writepages_fill()->tree_insert() with num_pages == 0 corrupts fi->writepages tree.
    Normally we have half-closed intervals in the tree:


    [5, 6)
    / \
    [1, 3) [7, 9)

    But tree_insert(num_pages == 0) adds an abnormal interval with both ends included:

    [5, 5]
    / \
    [1, 3) [7, 9)


    This may seriously confuse a reader iterating a tree, which does not know about special case (num_pages == 0).
    As I see, nobody in the code cares about num_pages == 0, and there is no comment about that case.

    This will fire soon or later. I think we should stop insert abnormal intervals (num_pages == 0) there.

    Reasons fuse_writepages_fill() does use this (num_pages == 0)?!

    \
     
     \ /
      Last update: 2020-06-18 12:31    [W:2.128 / U:0.160 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site