Re: [PATCH] shmem: don't call put_super() when fill_super() failed.

From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
To: Eric Biggers <ebiggers3@gmail.com>
Cc: syzbot+d2586fde8fdcead3647f@syzkaller.appspotmail.com,
	viro@ZenIV.linux.org.uk, hughd@google.com,
	syzkaller-bugs@googlegroups.com, linux-mm@kvack.org,
	Dave Chinner <dchinner@redhat.com>
Subject: Re: [PATCH] shmem: don't call put_super() when fill_super() failed.
Date: Tue, 15 May 2018 09:27:35 +0900	[thread overview]
Message-ID: <201805150027.w4F0RZ27055056@www262.sakura.ne.jp> (raw)
In-Reply-To: <20180514171154.GB252575@gmail.com>

Eric Biggers wrote:
> > I'm not following, since generic_shutdown_super() only calls ->put_super() if
> > ->s_root is set, which only happens at the end of shmem_fill_super().  Isn't the
> > real problem that s_shrink is registered too early, causing super_cache_count()
> > and shmem_unused_huge_count() to potentially run before shmem_fill_super() has
> > completed?  Or alternatively, the problem is that super_cache_count() doesn't
> > check for SB_ACTIVE.
> > 
> 
> Coincidentally, this is already going to be fixed by commit 79f546a696bff259
> ("fs: don't scan the inode cache before SB_BORN is set") in vfs/for-linus.
> 

Just an idea, but if shrinker registration is too early, can't we postpone it
like below?

--- a/fs/super.c
+++ b/fs/super.c
@@ -521,7 +521,6 @@ struct super_block *sget_userns(struct file_system_type *type,
 	hlist_add_head(&s->s_instances, &type->fs_supers);
 	spin_unlock(&sb_lock);
 	get_filesystem(type);
-	register_shrinker_prepared(&s->s_shrink);
 	return s;
 }
 
@@ -1287,6 +1286,7 @@ struct dentry *
 	WARN((sb->s_maxbytes < 0), "%s set sb->s_maxbytes to "
 		"negative value (%lld)\n", type->name, sb->s_maxbytes);
 
+	register_shrinker_prepared(&sb->s_shrink);
 	up_write(&sb->s_umount);
 	free_secdata(secdata);
 	return root;
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -313,6 +313,7 @@ int prealloc_shrinker(struct shrinker *shrinker)
 	shrinker->nr_deferred = kzalloc(size, GFP_KERNEL);
 	if (!shrinker->nr_deferred)
 		return -ENOMEM;
+	INIT_LIST_HEAD(&shrinker->list);
 	return 0;
 }
 
