From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Johannes Weiner <hannes@cmpxchg.org>,
Jan Kara <jack@suse.cz>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.8 26/57] mm: filemap: dont plant shadow entries without radix tree node
Date: Fri, 21 Oct 2016 11:17:49 +0200 [thread overview]
Message-ID: <20161021091436.658602764@linuxfoundation.org> (raw)
In-Reply-To: <20161021091435.435647262@linuxfoundation.org>
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <hannes@cmpxchg.org>
commit d3798ae8c6f3767c726403c2ca6ecc317752c9dd upstream.
When the underflow checks were added to workingset_node_shadow_dec(),
they triggered immediately:
kernel BUG at ./include/linux/swap.h:276!
invalid opcode: 0000 [#1] SMP
Modules linked in: isofs usb_storage fuse xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_REJECT nf_reject_ipv6
soundcore wmi acpi_als pinctrl_sunrisepoint kfifo_buf tpm_tis industrialio acpi_pad pinctrl_intel tpm_tis_core tpm nfsd auth_rpcgss nfs_acl lockd grace sunrpc dm_crypt
CPU: 0 PID: 20929 Comm: blkid Not tainted 4.8.0-rc8-00087-gbe67d60ba944 #1
Hardware name: System manufacturer System Product Name/Z170-K, BIOS 1803 05/06/2016
task: ffff8faa93ecd940 task.stack: ffff8faa7f478000
RIP: page_cache_tree_insert+0xf1/0x100
Call Trace:
__add_to_page_cache_locked+0x12e/0x270
add_to_page_cache_lru+0x4e/0xe0
mpage_readpages+0x112/0x1d0
blkdev_readpages+0x1d/0x20
__do_page_cache_readahead+0x1ad/0x290
force_page_cache_readahead+0xaa/0x100
page_cache_sync_readahead+0x3f/0x50
generic_file_read_iter+0x5af/0x740
blkdev_read_iter+0x35/0x40
__vfs_read+0xe1/0x130
vfs_read+0x96/0x130
SyS_read+0x55/0xc0
entry_SYSCALL_64_fastpath+0x13/0x8f
Code: 03 00 48 8b 5d d8 65 48 33 1c 25 28 00 00 00 44 89 e8 75 19 48 83 c4 18 5b 41 5c 41 5d 41 5e 5d c3 0f 0b 41 bd ef ff ff ff eb d7 <0f> 0b e8 88 68 ef ff 0f 1f 84 00
RIP page_cache_tree_insert+0xf1/0x100
This is a long-standing bug in the way shadow entries are accounted in
the radix tree nodes. The shrinker needs to know when radix tree nodes
contain only shadow entries, no pages, so node->count is split in half
to count shadows in the upper bits and pages in the lower bits.
Unfortunately, the radix tree implementation doesn't know of this and
assumes all entries are in node->count. When there is a shadow entry
directly in root->rnode and the tree is later extended, the radix tree
implementation will copy that entry into the new node and and bump its
node->count, i.e. increases the page count bits. Once the shadow gets
removed and we subtract from the upper counter, node->count underflows
and triggers the warning. Afterwards, without node->count reaching 0
again, the radix tree node is leaked.
Limit shadow entries to when we have actual radix tree nodes and can
count them properly. That means we lose the ability to detect refaults
from files that had only the first page faulted in at eviction time.
Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reported-and-tested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/radix-tree.h | 6 ++---
lib/radix-tree.c | 14 ++-----------
mm/filemap.c | 46 +++++++++++++++++++++++++++++----------------
3 files changed, 36 insertions(+), 30 deletions(-)
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -280,9 +280,9 @@ bool __radix_tree_delete_node(struct rad
struct radix_tree_node *node);
void *radix_tree_delete_item(struct radix_tree_root *, unsigned long, void *);
void *radix_tree_delete(struct radix_tree_root *, unsigned long);
-struct radix_tree_node *radix_tree_replace_clear_tags(
- struct radix_tree_root *root,
- unsigned long index, void *entry);
+void radix_tree_clear_tags(struct radix_tree_root *root,
+ struct radix_tree_node *node,
+ void **slot);
unsigned int radix_tree_gang_lookup(struct radix_tree_root *root,
void **results, unsigned long first_index,
unsigned int max_items);
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -1583,15 +1583,10 @@ void *radix_tree_delete(struct radix_tre
}
EXPORT_SYMBOL(radix_tree_delete);
-struct radix_tree_node *radix_tree_replace_clear_tags(
- struct radix_tree_root *root,
- unsigned long index, void *entry)
+void radix_tree_clear_tags(struct radix_tree_root *root,
+ struct radix_tree_node *node,
+ void **slot)
{
- struct radix_tree_node *node;
- void **slot;
-
- __radix_tree_lookup(root, index, &node, &slot);
-
if (node) {
unsigned int tag, offset = get_slot_offset(node, slot);
for (tag = 0; tag < RADIX_TREE_MAX_TAGS; tag++)
@@ -1600,9 +1595,6 @@ struct radix_tree_node *radix_tree_repla
/* Clear root node tags */
root->gfp_mask &= __GFP_BITS_MASK;
}
-
- radix_tree_replace_slot(slot, entry);
- return node;
}
/**
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -169,33 +169,35 @@ static int page_cache_tree_insert(struct
static void page_cache_tree_delete(struct address_space *mapping,
struct page *page, void *shadow)
{
- struct radix_tree_node *node;
int i, nr = PageHuge(page) ? 1 : hpage_nr_pages(page);
VM_BUG_ON_PAGE(!PageLocked(page), page);
VM_BUG_ON_PAGE(PageTail(page), page);
VM_BUG_ON_PAGE(nr != 1 && shadow, page);
- if (shadow) {
- mapping->nrexceptional += nr;
- /*
- * Make sure the nrexceptional update is committed before
- * the nrpages update so that final truncate racing
- * with reclaim does not see both counters 0 at the
- * same time and miss a shadow entry.
- */
- smp_wmb();
- }
- mapping->nrpages -= nr;
-
for (i = 0; i < nr; i++) {
- node = radix_tree_replace_clear_tags(&mapping->page_tree,
- page->index + i, shadow);
+ struct radix_tree_node *node;
+ void **slot;
+
+ __radix_tree_lookup(&mapping->page_tree, page->index + i,
+ &node, &slot);
+
+ radix_tree_clear_tags(&mapping->page_tree, node, slot);
+
if (!node) {
VM_BUG_ON_PAGE(nr != 1, page);
- return;
+ /*
+ * We need a node to properly account shadow
+ * entries. Don't plant any without. XXX
+ */
+ shadow = NULL;
}
+ radix_tree_replace_slot(slot, shadow);
+
+ if (!node)
+ break;
+
workingset_node_pages_dec(node);
if (shadow)
workingset_node_shadows_inc(node);
@@ -219,6 +221,18 @@ static void page_cache_tree_delete(struc
&node->private_list);
}
}
+
+ if (shadow) {
+ mapping->nrexceptional += nr;
+ /*
+ * Make sure the nrexceptional update is committed before
+ * the nrpages update so that final truncate racing
+ * with reclaim does not see both counters 0 at the
+ * same time and miss a shadow entry.
+ */
+ smp_wmb();
+ }
+ mapping->nrpages -= nr;
}
/*
next prev parent reply other threads:[~2016-10-21 9:21 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20161021092156uscas1p2448161ce8162a8e99cfe189d1b435176@uscas1p2.samsung.com>
2016-10-21 9:17 ` [PATCH 4.8 00/57] 4.8.4-stable review Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 03/57] serial: 8250_dw: Check the data->pclk when get apb_pclk Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 04/57] serial: 8250_port: fix runtime PM use in __do_stop_tx_rs485() Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 05/57] ARCv2: intc: Use kflag if STATUS32.IE must be reset Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 06/57] ARCv2: fix local_save_flags Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 07/57] debugfs: introduce a public file_operations accessor Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 08/57] b43: fix debugfs crash Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 09/57] b43legacy: " Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 10/57] carl9170: fix debugfs crashes Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 14/57] btrfs: assign error values to the correct bio structs Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 15/57] mei: amthif: fix deadlock in initialization during a reset Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 16/57] drivers: base: dma-mapping: page align the size when unmap_kernel_range Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 17/57] IB/hfi1: Fix defered ack race with qp destroy Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 18/57] clk: mvebu: fix setting unwanted flags in CP110 gate clock Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 19/57] clk: mvebu: dynamically allocate resources in Armada CP110 system controller Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 20/57] fuse: listxattr: verify xattr list Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 22/57] fuse: fix killing s[ug]id in setattr Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 23/57] mm: filemap: fix mapping->nrpages double accounting in fuse Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 24/57] i40e: avoid NULL pointer dereference and recursive errors on early PCI error Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 25/57] xfs: change mailing list address Greg Kroah-Hartman
2016-10-21 9:17 ` Greg Kroah-Hartman [this message]
2016-10-21 9:17 ` [PATCH 4.8 27/57] brcmfmac: fix pmksa->bssid usage Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 30/57] ASoC: nau8825: fix bug in FLL parameter Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 31/57] ASoC: Intel: Atom: add a missing star in a memcpy call Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 32/57] reiserfs: Unlock superblock before calling reiserfs_quota_on_mount() Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 33/57] async_pq_val: fix DMA memory leak Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 34/57] autofs: Fix automounts by using current_real_cred()->uid Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 35/57] scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() Greg Kroah-Hartman
2016-10-21 9:17 ` [PATCH 4.8 36/57] scsi: arcmsr: Simplify user_len checking Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 37/57] scsi: ibmvfc: Fix I/O hang when port is not mapped Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 38/57] ipc/sem.c: fix complex_count vs. simple op race Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 39/57] mm/hugetlb: fix memory offline with hugepage size > memory block size Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 40/57] vfs,mm: fix a dead loop in truncate_inode_pages_range() Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 41/57] jbd2: fix lockdep annotation in add_transaction_credits() Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 42/57] ext4: enforce online defrag restriction for encrypted files Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 43/57] ext4: reinforce check of i_dtime when clearing high fields of uid and gid Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 45/57] ext4: fix memory leak in ext4_insert_range() Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 46/57] ext4: fix memory leak when symlink decryption fails Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 47/57] ext4: allow DAX writeback for hole punch Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 48/57] ext4: release bh in make_indexed_dir Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 49/57] ext4: unmap metadata when zeroing blocks Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 50/57] crypto: ghash-generic - move common definitions to a new header file Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 51/57] crypto: vmx - Fix memory corruption caused by p8_ghash Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 52/57] dlm: free workqueues after the connections Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 53/57] vfs: move permission checking into notify_change() for utimes(NULL) Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 54/57] cachefiles: Fix attempt to read i_blocks after deleting file [ver #2] Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 55/57] drm: virtio: reinstate drm_virtio_set_busid() Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 56/57] acpi, nfit: check for the correct event code in notifications Greg Kroah-Hartman
2016-10-21 9:18 ` [PATCH 4.8 57/57] cfq: fix starvation of asynchronous writes Greg Kroah-Hartman
2016-10-21 9:18 ` Greg Kroah-Hartman
2016-10-21 15:46 ` [PATCH 4.8 00/57] 4.8.4-stable review Shuah Khan
2016-10-22 9:56 ` Greg Kroah-Hartman
2016-10-21 19:17 ` Guenter Roeck
2016-10-22 9:56 ` Greg Kroah-Hartman
2016-10-21 21:02 ` Rafael J. Wysocki
2016-10-22 9:58 ` Greg Kroah-Hartman
2016-10-23 0:04 ` Rafael J. Wysocki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161021091436.658602764@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=hannes@cmpxchg.org \
--cc=jack@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.