Re: deadlocks caused by ext3/reiser dirty_inode calls during do_mmap_pgoff

[Andrew Morton <akpm@osdl.org>]

Chris Mason <mason@suse.com> wrote:
>
> do_mmap_pgoff is called with a write lock on mmap_sem, and can trigger
> calls to generic_file_mmap, which calls file_accessed to update the
> atime on the file.
> 
> For reiserfs, this might start a transaction, which might have to wait
> for the currently running transaction to finish.  It looks like ext3 may
> do the same thing, but I'm not 100% sure on that.
> 
> If the currently running transaction happens to by running
> copy_from_user, like we do during write calls, it might be trying to get
> a hold of a read lock on the mmap sem while trying to hand page faults.

heh, good luck writing a testcase.

It's super-improbable because we fault the source page in by hand in
generic_file_aio_write_nolock() via fault_in_pages_readable().  Of course,
that prefaulting isn't 100% reliable either, because the VM can come in and
steal the page (or at least unmap its pte) before we get to doing the copy.

I think we can fix both problems by changing filemap_copy_from_user() and
filemap_copy_from_user_iovec() to not fall back to kmap() - just fail the
copy in some way if the atomic copy failed.  Then, in
generic_file_aio_write_nolock(), do a zero-length ->commit_write(),
put_page(), then go back and retry the whole thing, starting with
fault_in_pages_readable().