[PATCH] mm: Fix readahead_page_batch for retry entries

[PATCH] mm: Fix readahead_page_batch for retry entries

[Matthew Wilcox (Oracle)]

Both btrfs and fuse have reported faults caused by seeing a retry
entry instead of the page they were looking for.  This was caused
by a missing check in the iterator.

Reported-by: David Sterba <dsterba@suse.com>
Reported-by: Wonhyuk Yang <vvghjk1234@gmail.com>
Fixes: 042124cc64c3 ("mm: add new readahead_control API")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>

diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index b921581a7dcf..2ea741c2bb16 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -751,6 +751,8 @@ static inline unsigned int __readahead_batch(struct readahead_control *rac,
 	xas_set(&xas, rac->_index);
 	rcu_read_lock();
 	xas_for_each(&xas, page, rac->_index + rac->_nr_pages - 1) {
+		if (xas_retry(&xas, page))
+			continue;
 		VM_BUG_ON_PAGE(!PageLocked(page), page);
 		VM_BUG_ON_PAGE(PageTail(page), page);
 		array[i++] = page;

Re: [PATCH] mm: Fix readahead_page_batch for retry entries

[Andrew Morton]

On Tue,  3 Nov 2020 14:28:52 +0000 "Matthew Wilcox (Oracle)" <willy@infradead.org> wrote:

> Both btrfs and fuse have reported faults caused by seeing a retry
> entry instead of the page they were looking for.  This was caused
> by a missing check in the iterator.

Ambiguous.  What sort of "faults"?  Kernel pagefaults which cause
oopses?

It would be helpful to to provide sufficient info so that a reader of
this changelog can recognize whether this patch might fix some problem
which is being observed.

> Reported-by: David Sterba <dsterba@suse.com>
> Reported-by: Wonhyuk Yang <vvghjk1234@gmail.com>

Perhaps via links to these reports.

> Fixes: 042124cc64c3 ("mm: add new readahead_control API")

So I'm assuming we need a cc:stable, but it isn't yet fully clear?

> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
> 
> diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h

Please don't forget the "^---$" separator, thanks.

Re: [PATCH] mm: Fix readahead_page_batch for retry entries

[David Sterba]

On Tue, Nov 03, 2020 at 05:10:54PM -0800, Andrew Morton wrote:
> On Tue,  3 Nov 2020 14:28:52 +0000 "Matthew Wilcox (Oracle)" <willy@infradead.org> wrote:
> 
> > Both btrfs and fuse have reported faults caused by seeing a retry
> > entry instead of the page they were looking for.  This was caused
> > by a missing check in the iterator.
> 
> Ambiguous.  What sort of "faults"?  Kernel pagefaults which cause
> oopses?
> 
> It would be helpful to to provide sufficient info so that a reader of
> this changelog can recognize whether this patch might fix some problem
> which is being observed.
> 
> > Reported-by: David Sterba <dsterba@suse.com>
> > Reported-by: Wonhyuk Yang <vvghjk1234@gmail.com>
> 
> Perhaps via links to these reports.

Reported by irc/mail, I'll try to dig the stack trace from the logs
again. The crash is hard to hit, there was just one occurence since 5.8
times.

Re: [PATCH] mm: Fix readahead_page_batch for retry entries

[Wonhyuk Yang]

On Wed, Nov 4, 2020 at 10:10 AM Andrew Morton <akpm@linux-foundation.org> wrote:

> It would be helpful to to provide sufficient info so that a reader of
> this changelog can recognize whether this patch might fix some problem
> which is being observed.

As you can see below the panic log, the accessing 0x402 causes panic.
In the xarray.h, 0x402 means RETRY_ENTRY.

BUG: kernel NULL pointer dereference, address: 0000000000000402
CPU: 14 PID: 306003 Comm: as Not tainted 5.9.0-1-amd64 #1 Debian 5.9.1-1
Hardware name: Lenovo ThinkSystem SR665/7D2VCTO1WW, BIOS D8E106Q-1.01 05/30/2020
RIP: 0010:fuse_readahead+0x152/0x470 [fuse]
Code: 41 8b 57 18 4c 8d 54 10 ff 4c 89 d6 48 8d 7c 24 10 e8 d2 e3 28
f9 48 85 c0 0f 84 fe 00 00 00 44 89 f2 49 89 04 d4 44 8d 72 01 <48> 8b
10 41 8b 4f 1c 48 c1 ea 10 83 e2 01 80 fa 01 19 d2 81 e2 01
RSP: 0018:ffffad99ceaebc50 EFLAGS: 00010246
RAX: 0000000000000402 RBX: 0000000000000001 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffff94c5af90bd98 RDI: ffffad99ceaebc60
RBP: ffff94ddc1749a00 R08: 0000000000000402 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000100 R12: ffff94de6c429ce0
R13: ffff94de6c4d3700 R14: 0000000000000001 R15: ffffad99ceaebd68
FS:  00007f228c5c7040(0000) GS:ffff94de8ed80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000402 CR3: 0000001dbd9b4000 CR4: 0000000000350ee0
Call Trace:
  read_pages+0x83/0x270
  page_cache_readahead_unbounded+0x197/0x230
  generic_file_buffered_read+0x57a/0xa20
  new_sync_read+0x112/0x1a0
  vfs_read+0xf8/0x180
  ksys_read+0x5f/0xe0
  do_syscall_64+0x33/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xa9