Re: [RFC][PATCH 1/3] radix priority search tree - objrmap complexity fix

[Andrea Arcangeli <andrea@suse.de>]

On Mon, Mar 29, 2004 at 02:42:43PM -0800, Andrew Morton wrote:
> diff -puN mm/page_io.c~rw_swap_page_sync-fix mm/page_io.c
> --- 25/mm/page_io.c~rw_swap_page_sync-fix	Mon Mar 29 14:41:08 2004
> +++ 25-akpm/mm/page_io.c	Mon Mar 29 14:41:28 2004
> @@ -139,7 +139,7 @@ struct address_space_operations swap_aop
>  
>  /*
>   * A scruffy utility function to read or write an arbitrary swap page
> - * and wait on the I/O.
> + * and wait on the I/O.  The caller must have a ref on the page.
>   */
>  int rw_swap_page_sync(int rw, swp_entry_t entry, struct page *page)
>  {
> @@ -151,8 +151,7 @@ int rw_swap_page_sync(int rw, swp_entry_
>  	lock_page(page);
>  
>  	BUG_ON(page->mapping);
> -	page->mapping = &swapper_space;
> -	page->index = entry.val;
> +	add_to_page_cache(page, &swapper_space, entry.val, GFP_NOIO);
>  
>  	if (rw == READ) {
>  		ret = swap_readpage(NULL, page);
> @@ -161,7 +160,12 @@ int rw_swap_page_sync(int rw, swp_entry_
>  		ret = swap_writepage(page, &swap_wbc);
>  		wait_on_page_writeback(page);
>  	}
> -	page->mapping = NULL;
> +
> +	lock_page(page);
> +	remove_from_page_cache(page);
> +	unlock_page(page);
> +	page_cache_release(page);	/* For add_to_page_cache() */
> +
>  	if (ret == 0 && (!PageUptodate(page) || PageError(page)))
>  		ret = -EIO;
>  	return ret;

I checked this into CVS last night and today I got this new oops in
bugzilla:

hda: completing PM request, resume
Writing data to swap (18536 pages): .<1>Unable to handle kernel NULL pointer dereference at virtual address 00000004
 printing eip:
c01daf24
*pde = 00000000
Oops: 0000 [#1]
CPU:    0
EIP:    0060:[<c01daf24>]    Tainted: P
EFLAGS: 00010082   (2.6.4-40.3-default)
EIP is at radix_tree_delete+0x14/0x160
eax: 00000004   ebx: c16b6880   ecx: 00000016   edx: 00001d69
esi: 00001d69   edi: 00000010   ebp: 000011ae   esp: f7329e1c
ds: 007b   es: 007b   ss: 0068
Process powersaved (pid: 4216, threadinfo=f7328000 task=f751f250)
Stack: 00000000 f51b6e00 00000004 00000006 f6326200 f63262bc 0000002e c0108d48
       c041f4c0 00000000 000003fd 000026cd c041f4c0 c03ffd45 00000320 0000007b
       0000007b ffffff00 c021b78e c16b6880 c0342d60 000011ae 000011ae 000011ae
Call Trace:
 [<c0108d48>] common_interrupt+0x18/0x20
 [<c021b78e>] serial_in+0x1e/0x40
 [<c0150f2c>] swap_free+0x1c/0x30
 [<c0152897>] remove_exclusive_swap_page+0x97/0x155
 [<c013be2f>] __remove_from_page_cache+0x3f/0xa0
 [<c013beab>] remove_from_page_cache+0x1b/0x27
 [<c014fe5c>] rw_swap_page_sync+0x9c/0x1b0
 [<c0135a9d>] do_magic_suspend_2+0x27d/0x7d0
 [<c0125fb0>] process_timeout+0x0/0x10
 [<c011ad1e>] __wake_up+0xe/0x20
 [<f952be8d>] snd_intel8x0_suspend+0x1d/0x40 [snd_intel8x0]
 [<c01e3586>] pci_device_suspend+0x16/0x20
 [<c027701d>] do_magic+0x4d/0x130
 [<c0135520>] software_suspend+0xd0/0xe0
 [<c01fc176>] acpi_system_write_sleep+0xb5/0xd2
 [<c01fc0c1>] acpi_system_write_sleep+0x0/0xd2
 [<c015514e>] vfs_write+0xae/0xf0
 [<c015522c>] sys_write+0x2c/0x50
 [<c0107dc9>] sysenter_past_esp+0x52/0x79

Code: 8b 28 8d 7c 24 10 3b 14 ad a0 b9 41 c0 0f 87 18 01 00 00 8d

the oops is in a different place. It seems to bomb in
__remove_from_page_cache while calling radix_tree_delete like if the
radix_tree_insert didn't work out. I believe it's because you're not
checking for the retval of add_to_page_cache, if it runs oom in the
radix tree insert it will crash. You used GFP_NOIO, that's wrong, it
should be GFP_KERNEL to guarantee allocation. There's no reason to use
GFP_NOIO as far as I can tell.

Furthermore I was thinking your patch is still too lowlevel, it's better
to use the swapcache entry/exit points that already do the hardness
checks and page_cache_release automatically plus it pins the swap page
so there's no risk of disk corruption etc...

So I rewritten the fix this way:


diff -urNp --exclude CVS --exclude BitKeeper --exclude {arch} --exclude .arch-ids x-ref/mm/page_io.c x/mm/page_io.c
--- x-ref/mm/page_io.c	2004-03-31 16:57:25.505978008 +0200
+++ x/mm/page_io.c	2004-03-31 17:06:07.028694504 +0200
@@ -139,7 +139,7 @@ struct address_space_operations swap_aop
 
 /*
  * A scruffy utility function to read or write an arbitrary swap page
- * and wait on the I/O.
+ * and wait on the I/O.  The caller must have a ref on the page.
  */
 int rw_swap_page_sync(int rw, swp_entry_t entry, struct page *page)
 {
@@ -149,10 +149,9 @@ int rw_swap_page_sync(int rw, swp_entry_
 	};
 
 	lock_page(page);
-
-	BUG_ON(page->mapping);
-	page->mapping = &swapper_space;
-	page->index = entry.val;
+	ret = add_to_swap_cache(page, entry);
+	if (unlikely(ret))
+		goto out_unlock;
 
 	if (rw == READ) {
 		ret = swap_readpage(NULL, page);
@@ -161,7 +160,12 @@ int rw_swap_page_sync(int rw, swp_entry_
 		ret = swap_writepage(page, &swap_wbc);
 		wait_on_page_writeback(page);
 	}
-	page->mapping = NULL;
+
+	lock_page(page);
+	delete_from_swap_cache(page);
+ out_unlock:
+	unlock_page(page);
+
 	if (ret == 0 && (!PageUptodate(page) || PageError(page)))
 		ret = -EIO;
 	return ret;


I hope this will work (untested).