Re: mapped pages being truncated [was Re: 2.6.5-rc2-aa5]

[Andrea Arcangeli <andrea@suse.de>]

On Tue, Mar 30, 2004 at 07:01:44PM +0100, Hugh Dickins wrote:
> On Tue, 30 Mar 2004, Andrea Arcangeli wrote:
> > 
> > the funny thing is that it seems to be the same truncate doing
> > truncate_inode_pages first, and zap_page_range later. It would be better
> > if WARN_ON would show the pid of the task too, if they were two
> > different tasks that would be more realistic. Maybe an xfs screwup of
> > some sort? I could ask the tester to try again with ext2, but then if it
> > doesn't trigger anymore we still have to wonder about timings.
> > 
> > Anyways now the kernel is solid, it just bugs out those warnings so we
> > don't forget. I don't think it's a bug in my tree.
> 
> I do think it's something to worry about, it does seem peculiar.
> 
> Dunno why, but I never received the first mail in this thread,
> neither directly nor via the list, but have now got it from MARC.
> 
> I doubt this is the cause of the problem (would not, I think,
> cause all of the associated symptoms you describe), but I think it
> is a bug in your code which could cause the WARN_ON(!page->mapping):

note that the very same bug triggers with objrmap only applied (before I
applied anon-vma and prio-tree on top of it), so at very least this is a
bug in Dave's code too. See the same BUG_ON triggering in rmap.c before
I replace it with objrmap.c in anon-vma. Almost certainly it will trigger with
your patches applied too and probably it happens with mainline 2.6 too
but nobody tested that yet.

> Imagine if the filesystem (or driver) nopage gave you the empty zero
> page for a private writable mapping (it better not give it you for a
> shared writable mapping!), perhaps to represent a hole in the file.

zero page is reserved, so page_add_rmap does nothing on it, zero page is
gauranteed to have page->mapcount == 0.

> I think it will pass the various tests in your do_no_page, and if

zero page will get intercepted in the page-reserved checks, so
page_add_rmap is a noop and the zero page has always page->mapcount == 0.

Furthermore I WARN_ON if anybody returns a page->mapping == NULL on a
non-reserved VMA, so it can't be the case (zeropage has page->mapping =
NULL).

> it's a write_access, that will correctly copy the page and set_pte
> for this private copy: but it doesn't update pageable (from 0 to 1)
> for it, so skips the page_add_rmap; and eventually page_remove_rmap
> will be passed this page with neither PageAnon nor page->mapping.

A COW on a zero page will call page_add_rmap on the copy just fine and
it will call page_remove_rmap on the old page as well, though the
latter will be a noop for a reserved page or for a page with
page->mapping == 0 like the zero page is.

> As I say, I doubt it's your case, but worth fixing:
> force pageable on where you set anon in do_no_page.

there's no bug to fix in my code as far as I can tell. You probably
overlooked the zeropage is reserved.