From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757590AbcHWVRK (ORCPT ); Tue, 23 Aug 2016 17:17:10 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:44779 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755601AbcHWVRF (ORCPT ); Tue, 23 Aug 2016 17:17:05 -0400 Subject: Re: 9p2000.L stat/unlink race (WARNING: fs/inode.c:280 drop_nlink) To: Eric Van Hensbergen , Ron Minnich , Latchesar Ionkov , Al Viro References: Cc: v9fs-developer@lists.sourceforge.net, linux-fsdevel@vger.kernel.org, LKML From: Vegard Nossum Message-ID: <36dd3faf-50ec-5e7b-1740-3a2a616bc625@oracle.com> Date: Tue, 23 Aug 2016 23:16:35 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 08/21/2016 01:55 PM, Vegard Nossum wrote: > Hi, > > I've been seeing this: > > ------------[ cut here ]------------ > WARNING: CPU: 0 PID: 2377 at fs/inode.c:280 drop_nlink+0xc2/0x120 > Kernel panic - not syncing: panic_on_warn set ... > > CPU: 0 PID: 2377 Comm: syz-executor Not tainted 4.8.0-rc2+ #145 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 > 0000000000000000 ffff880116437b50 ffffffff81f9f201 ffffffff83e72d60 > ffff880116437c28 ffffffff83ef6100 ffffffff847070c0 ffff880116437c18 > ffffffff8150538a 0000000041b58ab3 ffffffff844dc5dd ffffffff815051a7 > Call Trace: > [] dump_stack+0x83/0xb2 > [] panic+0x1e3/0x3a1 > [] ? set_ti_thread_flag+0x1e/0x1e > [] ? rt_mutex_top_waiter.part.10+0x6/0x6 > [] ? p9_idpool_put+0x36/0x40 > [] ? drop_nlink+0xc2/0x120 > [] __warn+0x1bf/0x1e0 > [] warn_slowpath_null+0x2c/0x40 > [] drop_nlink+0xc2/0x120 > [] v9fs_remove+0x256/0x2d0 > [] v9fs_vfs_unlink+0x1f/0x30 > [] vfs_unlink+0x2b0/0x490 > [] do_unlinkat+0x530/0x660 > [] ? vfs_unlink+0x490/0x490 > [] ? syscall_trace_enter+0x3cf/0xdb0 > [] ? __context_tracking_exit.part.4+0x9a/0x1e0 > [] ? exit_to_usermode_loop+0x190/0x190 > [] ? check_preemption_disabled+0x37/0x1e0 > [] ? __this_cpu_preempt_check+0x1c/0x20 > [] ? SyS_unlinkat+0x80/0x80 > [] SyS_unlink+0x1a/0x20 > [] do_syscall_64+0x1c4/0x4e0 > [] entry_SYSCALL64_slow_path+0x25/0x25 > > It seems to happen when fstat() calls into v9fs_vfs_getattr_dotl() and > that does a v9fs_stat2inode_dotl() which changes inode->i_nlink from 1 > to 0 (without any locking). The unlink() which was already in progress > then sees 0 when it does drop_nlink(). > > My mount flags are: > > trans=virtio,version=9p2000.L > > If I add "cache=loose" then there is no warning (as expected, since > v9fs_vfs_getattr_dotl() bails out early in that case and doesn't change > the in-memory inode). With cache=loose I'm also seeing this, which looks to me like it might be a related race: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5224 at mm/truncate.c:761 pagecache_isize_extended+0x188/0x1f0 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 5224 Comm: syz-executor Not tainted 4.8.0-rc2+ #161 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 0000000000000000 ffff88010f0dfae8 ffffffff81f9f1c1 ffffffff83e72d60 ffff88010f0dfbc0 ffffffff83ed1a00 ffffffff847070c0 ffff88010f0dfbb0 ffffffff8150534a 0000000041b58ab3 ffffffff844dc5cd ffffffff81505167 Call Trace: [] dump_stack+0x83/0xb2 [] panic+0x1e3/0x3a1 [] ? set_ti_thread_flag+0x1e/0x1e [] ? rt_mutex_top_waiter.part.10+0x6/0x6 [] ? pagecache_isize_extended+0x188/0x1f0 [] __warn+0x1bf/0x1e0 [] warn_slowpath_null+0x2c/0x40 [] pagecache_isize_extended+0x188/0x1f0 [] truncate_setsize+0x68/0xa0 [] v9fs_vfs_setattr_dotl+0x363/0x510 [] ? v9fs_mapped_iattr_valid+0x1f0/0x1f0 [] ? apparmor_path_rmdir+0x30/0x30 [] ? timespec_trunc+0x76/0xe0 [] ? v9fs_mapped_iattr_valid+0x1f0/0x1f0 [] notify_change+0x6dd/0xdd0 [] do_truncate+0x121/0x1c0 [] ? do_dentry_open+0xbc0/0xbc0 [] ? apparmor_path_rmdir+0x30/0x30 [] do_sys_ftruncate.constprop.9+0x34b/0x500 [] ? compat_SyS_truncate+0x30/0x30 [] SyS_ftruncate+0x1c/0x30 [] do_syscall_64+0x1c4/0x4e0 [] ? syscall_return_slowpath+0x16c/0x1d0 [] entry_SYSCALL64_slow_path+0x25/0x25 Vegard