From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>,
Hulk Robot <hulkci@huawei.com>,
Steve French <stfrench@microsoft.com>,
Ronnie Sahlberg <lsahlber@redhat.com>,
Sasha Levin <sashal@kernel.org>,
linux-cifs@vger.kernel.org, samba-technical@lists.samba.org
Subject: [PATCH AUTOSEL 5.4 30/40] cifs: Fix double add page to memcg when cifs_readpages
Date: Wed, 1 Jul 2020 21:23:51 -0400 [thread overview]
Message-ID: <20200702012402.2701121-30-sashal@kernel.org> (raw)
In-Reply-To: <20200702012402.2701121-1-sashal@kernel.org>
From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
[ Upstream commit 95a3d8f3af9b0d63b43f221b630beaab9739d13a ]
When xfstests generic/451, there is an BUG at mm/memcontrol.c:
page:ffffea000560f2c0 refcount:2 mapcount:0 mapping:000000008544e0ea
index:0xf
mapping->aops:cifs_addr_ops dentry name:"tst-aio-dio-cycle-write.451"
flags: 0x2fffff80000001(locked)
raw: 002fffff80000001 ffffc90002023c50 ffffea0005280088 ffff88815cda0210
raw: 000000000000000f 0000000000000000 00000002ffffffff ffff88817287d000
page dumped because: VM_BUG_ON_PAGE(page->mem_cgroup)
page->mem_cgroup:ffff88817287d000
------------[ cut here ]------------
kernel BUG at mm/memcontrol.c:2659!
invalid opcode: 0000 [#1] SMP
CPU: 2 PID: 2038 Comm: xfs_io Not tainted 5.8.0-rc1 #44
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_
073836-buildvm-ppc64le-16.ppc.4
RIP: 0010:commit_charge+0x35/0x50
Code: 0d 48 83 05 54 b2 02 05 01 48 89 77 38 c3 48 c7
c6 78 4a ea ba 48 83 05 38 b2 02 05 01 e8 63 0d9
RSP: 0018:ffffc90002023a50 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff88817287d000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88817ac97ea0 RDI: ffff88817ac97ea0
RBP: ffffea000560f2c0 R08: 0000000000000203 R09: 0000000000000005
R10: 0000000000000030 R11: ffffc900020237a8 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000001 R15: ffff88815a1272c0
FS: 00007f5071ab0800(0000) GS:ffff88817ac80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055efcd5ca000 CR3: 000000015d312000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
mem_cgroup_charge+0x166/0x4f0
__add_to_page_cache_locked+0x4a9/0x710
add_to_page_cache_locked+0x15/0x20
cifs_readpages+0x217/0x1270
read_pages+0x29a/0x670
page_cache_readahead_unbounded+0x24f/0x390
__do_page_cache_readahead+0x3f/0x60
ondemand_readahead+0x1f1/0x470
page_cache_async_readahead+0x14c/0x170
generic_file_buffered_read+0x5df/0x1100
generic_file_read_iter+0x10c/0x1d0
cifs_strict_readv+0x139/0x170
new_sync_read+0x164/0x250
__vfs_read+0x39/0x60
vfs_read+0xb5/0x1e0
ksys_pread64+0x85/0xf0
__x64_sys_pread64+0x22/0x30
do_syscall_64+0x69/0x150
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f5071fcb1af
Code: Bad RIP value.
RSP: 002b:00007ffde2cdb8e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000011
RAX: ffffffffffffffda RBX: 00007ffde2cdb990 RCX: 00007f5071fcb1af
RDX: 0000000000001000 RSI: 000055efcd5ca000 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000001000 R11: 0000000000000293 R12: 0000000000000001
R13: 000000000009f000 R14: 0000000000000000 R15: 0000000000001000
Modules linked in:
---[ end trace 725fa14a3e1af65c ]---
Since commit 3fea5a499d57 ("mm: memcontrol: convert page cache to a new
mem_cgroup_charge() API") not cancel the page charge, the pages maybe
double add to pagecache:
thread1 | thread2
cifs_readpages
readpages_get_pages
add_to_page_cache_locked(head,index=n)=0
| readpages_get_pages
| add_to_page_cache_locked(head,index=n+1)=0
add_to_page_cache_locked(head, index=n+1)=-EEXIST
then, will next loop with list head page's
index=n+1 and the page->mapping not NULL
readpages_get_pages
add_to_page_cache_locked(head, index=n+1)
commit_charge
VM_BUG_ON_PAGE
So, we should not do the next loop when any page add to page cache
failed.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/file.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 4959dbe740f71..ed17fa6c430ed 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -4269,7 +4269,8 @@ readpages_get_pages(struct address_space *mapping, struct list_head *page_list,
break;
__SetPageLocked(page);
- if (add_to_page_cache_locked(page, mapping, page->index, gfp)) {
+ rc = add_to_page_cache_locked(page, mapping, page->index, gfp);
+ if (rc) {
__ClearPageLocked(page);
break;
}
@@ -4285,6 +4286,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
struct list_head *page_list, unsigned num_pages)
{
int rc;
+ int err = 0;
struct list_head tmplist;
struct cifsFileInfo *open_file = file->private_data;
struct cifs_sb_info *cifs_sb = CIFS_FILE_SB(file);
@@ -4329,7 +4331,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
* the order of declining indexes. When we put the pages in
* the rdata->pages, then we want them in increasing order.
*/
- while (!list_empty(page_list)) {
+ while (!list_empty(page_list) && !err) {
unsigned int i, nr_pages, bytes, rsize;
loff_t offset;
struct page *page, *tpage;
@@ -4362,9 +4364,10 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
return 0;
}
- rc = readpages_get_pages(mapping, page_list, rsize, &tmplist,
+ nr_pages = 0;
+ err = readpages_get_pages(mapping, page_list, rsize, &tmplist,
&nr_pages, &offset, &bytes);
- if (rc) {
+ if (!nr_pages) {
add_credits_and_wake_if(server, credits, 0);
break;
}
--
2.25.1
next prev parent reply other threads:[~2020-07-02 1:33 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-02 1:23 [PATCH AUTOSEL 5.4 01/40] regmap: fix alignment issue Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 02/40] perf/x86/rapl: Move RAPL support to common x86 code Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 03/40] perf/x86/rapl: Fix RAPL config variable bug Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 04/40] ARM: dts: omap4-droid4: Fix spi configuration and increase rate Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 05/40] drm/ttm: Fix dma_fence refcnt leak when adding move fence Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 06/40] drm/tegra: hub: Do not enable orphaned window group Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 07/40] gpu: host1x: Detach driver on unregister Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 08/40] btrfs: use kfree() in btrfs_ioctl_get_subvol_info() Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 09/40] drm: mcde: Fix display initialization problem Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 10/40] ASoC: SOF: Intel: add PCI ID for CometLake-S Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 11/40] ASoC: SOF: Intel: add PCI IDs for ICL-H and TGL-H Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 12/40] net: usb: ax88179_178a: fix packet alignment padding Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 13/40] ALSA: hda: Intel: add missing PCI IDs for ICL-H, TGL-H and EKL Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 14/40] usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 15/40] spi: spidev: fix a race between spidev_release and spidev_remove Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 16/40] spi: spidev: fix a potential use-after-free in spidev_release() Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 17/40] net: ethernet: mvneta: Fix Serdes configuration for SoCs without comphy Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 18/40] net: ethernet: mvneta: Add 2500BaseX support " Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 19/40] tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 20/40] ixgbe: protect ring accesses with READ- and WRITE_ONCE Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 21/40] i40e: " Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 22/40] ibmvnic: continue to init in CRQ reset returns H_CLOSED Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 23/40] powerpc/kvm/book3s64: Fix kernel crash with nested kvm & DEBUG_VIRTUAL Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 24/40] usbnet: smsc95xx: Fix use-after-free after removal Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 25/40] iommu/vt-d: Don't apply gfx quirks to untrusted devices Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 26/40] drm: panel-orientation-quirks: Add quirk for Asus T101HA panel Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 27/40] drm: panel-orientation-quirks: Use generic orientation-data for Acer S1003 Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 28/40] s390/kasan: fix early pgm check handler execution Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 29/40] s390/debug: avoid kernel warning on too large number of pages Sasha Levin
2020-07-02 1:23 ` Sasha Levin [this message]
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 31/40] drm/sun4i: mixer: Call of_dma_configure if there's an IOMMU Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 32/40] cifs: update ctime and mtime during truncate Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 33/40] ARM: imx6: add missing put_device() call in imx6q_suspend_init() Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 34/40] scsi: mptscsih: Fix read sense data size Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 35/40] usb: dwc3: pci: Fix reference count leak in dwc3_pci_resume_work Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 36/40] block: release bip in a right way in error path Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 37/40] nvme-rdma: assign completion vector correctly Sasha Levin
2020-07-02 1:23 ` [PATCH AUTOSEL 5.4 38/40] x86/entry: Increase entry_stack size to a full page Sasha Levin
2020-07-02 1:24 ` [PATCH AUTOSEL 5.4 39/40] kgdb: Avoid suspicious RCU usage warning Sasha Levin
2020-07-02 1:24 ` [PATCH AUTOSEL 5.4 40/40] sched/core: Check cpus_mask, not cpus_ptr in __set_cpus_allowed_ptr(), to fix mask corruption Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200702012402.2701121-30-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=hulkci@huawei.com \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lsahlber@redhat.com \
--cc=samba-technical@lists.samba.org \
--cc=stable@vger.kernel.org \
--cc=stfrench@microsoft.com \
--cc=zhangxiaoxu5@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox