Re: [PATCH] per-backing dev unplugging #2

[Chris Mason <mason@suse.com>]

On Fri, 2004-03-12 at 15:02, Jens Axboe wrote:
> On Fri, Mar 12 2004, Andrew Morton wrote:
> > Chris Mason <mason@suse.com> wrote:
> > >
> > > During a mixed load test including fsx-linux and a bunch of procs
> > > running cp/read/rm loops, I got a null pointer deref with the call
> > > trace:
> > > 
> > > __lock_page->sync_page->block_sync_page
> > > 
> > > I don't see how we can trust page->mapping in this path, can't it
> > > disappear?  If so, it would be a bug without Jens' patch too, just
> > > harder to hit.

Here's my guess, it took a few hours to trigger the first time, so it'll
be a while before I can say if it makes a difference.  I'm not convinced
this will help, but it's all I can think of so far...

-chris

Index: linux.t/fs/buffer.c
===================================================================
--- linux.t.orig/fs/buffer.c	2004-03-12 13:13:45.000000000 -0500
+++ linux.t/fs/buffer.c	2004-03-12 15:21:44.635262192 -0500
@@ -2939,7 +2939,10 @@ EXPORT_SYMBOL(try_to_free_buffers);
 
 int block_sync_page(struct page *page)
 {
-	blk_run_address_space(page->mapping);
+	struct address_space *mapping;
+	smp_mb();
+	mapping = page->mapping;
+	blk_run_address_space(mapping);
 	return 0;
 }
 
Index: linux.t/mm/filemap.c
===================================================================
--- linux.t.orig/mm/filemap.c	2004-03-12 13:13:45.000000000 -0500
+++ linux.t/mm/filemap.c	2004-03-12 15:23:00.216089824 -0500
@@ -121,8 +121,10 @@ void remove_from_page_cache(struct page 
 
 static inline int sync_page(struct page *page)
 {
-	struct address_space *mapping = page->mapping;
-
+	struct address_space *mapping;
+	
+	smp_mb();
+	mapping = page->mapping;
 	if (mapping && mapping->a_ops && mapping->a_ops->sync_page)
 		return mapping->a_ops->sync_page(page);
 	return 0;