Race in pagevec_strip?

Race in pagevec_strip?

[Christoph Lameter]

Seems that we can call try_to_release_page with PagePrivate off and a 
valid mapping? This may cause all sorts of trouble for the 
filesystem *_releasepage() handlers. XFS bombs out in that case.

Lock the page before checking for page private.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.16-rc6/mm/swap.c
===================================================================
--- linux-2.6.16-rc6.orig/mm/swap.c	2006-03-11 14:12:55.000000000 -0800
+++ linux-2.6.16-rc6/mm/swap.c	2006-03-16 10:15:23.000000000 -0800
@@ -392,8 +392,9 @@ void pagevec_strip(struct pagevec *pvec)
 	for (i = 0; i < pagevec_count(pvec); i++) {
 		struct page *page = pvec->pages[i];
 
-		if (PagePrivate(page) && !TestSetPageLocked(page)) {
-			try_to_release_page(page, 0);
+		if (TestSetPageLocked(page)) {
+			if (PagePrivate(page))
+				try_to_release_page(page, 0);
 			unlock_page(page);
 		}
 	}

Re: Race in pagevec_strip?

[Christoph Lameter]

Sigh. TestSetPackLocked works just opposite of spin_trylock. So add an !


Seems that we can call try_to_release_page with PagePrivate off and a 
valid mapping? This may cause all sorts of trouble for the 
filesystem *_releasepage() handlers. XFS bombs out in that case.
 
Lock the page before checking for page private.
 
Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.16-rc6/mm/swap.c
===================================================================
--- linux-2.6.16-rc6.orig/mm/swap.c	2006-03-11 14:12:55.000000000 -0800
+++ linux-2.6.16-rc6/mm/swap.c	2006-03-16 10:15:23.000000000 -0800
@@ -392,8 +392,9 @@ void pagevec_strip(struct pagevec *pvec)
 	for (i = 0; i < pagevec_count(pvec); i++) {
 		struct page *page = pvec->pages[i];
 
-		if (PagePrivate(page) && !TestSetPageLocked(page)) {
-			try_to_release_page(page, 0);
+		if (!TestSetPageLocked(page)) {
+			if (PagePrivate(page))
+				try_to_release_page(page, 0);
 			unlock_page(page);
 		}
 	}

Re: Race in pagevec_strip?

[Hugh Dickins]

On Thu, 16 Mar 2006, Christoph Lameter wrote:
> Sigh. TestSetPackLocked works just opposite of spin_trylock. So add an !
> 
> 
> Seems that we can call try_to_release_page with PagePrivate off and a 
> valid mapping? This may cause all sorts of trouble for the 
> filesystem *_releasepage() handlers. XFS bombs out in that case.

I think you're right, and you are consistent with the sequence when
try_to_release_page is called from elsewhere.

But the last time I had anything to do with try_to_release_page was
way back in 2.5.mid, I don't think there was a pagevec_strip then.
Andrew will know better.

I can't see what protects the default drop_buffers case against this,
so can't argue that it's an XFS problem.

But wouldn't you, on balance, be better off repeating the
PagePrivate test within the lock?

		if (PagePrivate(page) && !TestSetPageLocked(page)) {
			if (PagePrivate(page))
				try_to_release_page(page, 0);
			unlock_page(page);
		}

>  
> Lock the page before checking for page private.
>  
> Signed-off-by: Christoph Lameter <clameter@sgi.com>
> 
> Index: linux-2.6.16-rc6/mm/swap.c
> ===================================================================
> --- linux-2.6.16-rc6.orig/mm/swap.c	2006-03-11 14:12:55.000000000 -0800
> +++ linux-2.6.16-rc6/mm/swap.c	2006-03-16 10:15:23.000000000 -0800
> @@ -392,8 +392,9 @@ void pagevec_strip(struct pagevec *pvec)
>  	for (i = 0; i < pagevec_count(pvec); i++) {
>  		struct page *page = pvec->pages[i];
>  
> -		if (PagePrivate(page) && !TestSetPageLocked(page)) {
> -			try_to_release_page(page, 0);
> +		if (!TestSetPageLocked(page)) {
> +			if (PagePrivate(page))
> +				try_to_release_page(page, 0);
>  			unlock_page(page);
>  		}
>  	}

Re: Race in pagevec_strip?

[Christoph Lameter]

On Thu, 16 Mar 2006, Hugh Dickins wrote:

> But wouldn't you, on balance, be better off repeating the
> PagePrivate test within the lock?

Good idea. That avoid uselessly taking the pagelock.



Seems that we can call try_to_release_page with PagePrivate off and a
valid mapping because we check PagePrivate before taking the page lock.
This may cause all sorts of trouble for thefilesystem *_releasepage()
handlers. XFS bombs out in that case.

Check the PagePrivate again before calling try_to_release_page.

Signed-off-by: Christoph Lameter <clameter@sgi.com>

Index: linux-2.6.16-rc6/mm/swap.c
===================================================================
--- linux-2.6.16-rc6.orig/mm/swap.c	2006-03-11 14:12:55.000000000 -0800
+++ linux-2.6.16-rc6/mm/swap.c	2006-03-16 11:46:54.000000000 -0800
@@ -393,7 +393,8 @@ void pagevec_strip(struct pagevec *pvec)
 		struct page *page = pvec->pages[i];
 
 		if (PagePrivate(page) && !TestSetPageLocked(page)) {
-			try_to_release_page(page, 0);
+			if (PagePrivate(page))
+				try_to_release_page(page, 0);
 			unlock_page(page);
 		}
 	}

Re: Race in pagevec_strip?

[Hugh Dickins]

On Thu, 16 Mar 2006, Hugh Dickins wrote:
> 
> I can't see what protects the default drop_buffers case against this,
> so can't argue that it's an XFS problem.

But I should add, I don't see what might be racing with what on the
same page, to cause the problem in practice.

Hugh

Re: Race in pagevec_strip?

[Christoph Lameter]

On Thu, 16 Mar 2006, Hugh Dickins wrote:

> On Thu, 16 Mar 2006, Hugh Dickins wrote:
> > 
> > I can't see what protects the default drop_buffers case against this,
> > so can't argue that it's an XFS problem.
> 
> But I should add, I don't see what might be racing with what on the
> same page, to cause the problem in practice.

The page is on the inactive list at the time pagevec_strip is called 
(see refill_inactive_zone). So kswapd could get to it. Could filesystems 
get to the page via the mapping?

Re: Race in pagevec_strip?

[Hugh Dickins]

On Thu, 16 Mar 2006, Christoph Lameter wrote:
> On Thu, 16 Mar 2006, Hugh Dickins wrote:
> > 
> > But I should add, I don't see what might be racing with what on the
> > same page, to cause the problem in practice.
> 
> The page is on the inactive list at the time pagevec_strip is called 
> (see refill_inactive_zone). So kswapd could get to it. Could filesystems 
> get to the page via the mapping?

A filesystem could get there, but I doubt it'd want to be releasing
buffers.  But now I see truncation's invalidate_complete_page,
that looks quite capable of racing with the kswapd instance.

Anyway, I don't disagree with your patch, and happy to see it now
in Linus' tree: was just wanting to make clear that I hadn't actually
seen the race in question, and didn't know if you were fixing a
potentiality or something actually seen.

Hugh

Re: Race in pagevec_strip?

[Christoph Lameter]

On Fri, 17 Mar 2006, Hugh Dickins wrote:

> Anyway, I don't disagree with your patch, and happy to see it now
> in Linus' tree: was just wanting to make clear that I hadn't actually
> seen the race in question, and didn't know if you were fixing a
> potentiality or something actually seen.

Seems that some of our engineers have been chasing that one for awhile.