public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [found?] Re: kernel BUG at buffer.c:827 in test12-pre6 and 7
@ 2000-12-08  9:58 Alexander Viro
  2000-12-08 18:11 ` [PATCH] " Alexander Viro
  0 siblings, 1 reply; 21+ messages in thread
From: Alexander Viro @ 2000-12-08  9:58 UTC (permalink / raw)
  To: David Woodhouse; +Cc: Linus Torvalds, linux-kernel

	I'm doing some massive grepping (basically, audit of page locking),
but nothing relevant so far. There was some catch (aside of documenting
the thing and finding several completely unrelated buglets):
	* ramfs_writepage() doesn't UnlockPage(). Deadlock.
	* udf_adinicb_writepage() does extra UnlockPage().
I don't see the fsckup in loop.c, though. On the read path it uses
do_generic_read_file() and on the write it's essentially the simplified
variant of generic_file_write(). Hell knows... It looks like we are
getting dirty buffer inheriting end_buffer_io_async from the previous
life.

	Oh, damn it. Indeed. Look: 

generic_file_write() or lo_send():
lock_page()
->prepare_write()	sets sync ->b_end_io
->commit_write()	puts them on the dirty list
UnlockPage()		releases the page lock
... requests are sent to driver

page_launder():
TryLockPage()		succeeds
block_write_full_page()
	... goes through the bh'es and sets ->b_end_io to end_buffer_io_async()
	at that point the last remaining request completes. It calls
	->b_end_io(), aka. end_buffer_io_async(). And does UnlockPage().

	In the meanwhile, we call ll_rw_block(). Requests are sent again.
	When _they_ complete we get the second UnlockPage()

Now, I might miss some obvious reason why it could never happen. Moreover,
the real problem may be completely different - the race above is not too wide.

However, I'ld really like to hear why the scenario above is impossible. BTW,
the race isn't even that narrow - if ->prepare_write() didn't cover the
whole page we've got a get_block() to call and there's a plenty of time when
shit can hit the fan - it's a blocking operation, after all.

Comments?
							Cheers,
								Al

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

^ permalink raw reply	[flat|nested] 21+ messages in thread

end of thread, other threads:[~2000-12-10  1:43 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <90rjbg$8eso1$1@fido.engr.sgi.com>
2000-12-08 22:22 ` [PATCH] Re: kernel BUG at buffer.c:827 in test12-pre6 and 7 Rajagopal Ananthanarayanan
2000-12-08  9:58 [found?] " Alexander Viro
2000-12-08 18:11 ` [PATCH] " Alexander Viro
2000-12-08 18:48   ` Linus Torvalds
2000-12-08 19:13     ` Alexander Viro
2000-12-08 19:39       ` Linus Torvalds
2000-12-08 19:50         ` Daniel Phillips
2000-12-08 21:17           ` Linus Torvalds
2000-12-08 22:30         ` Alexander Viro
2000-12-08 22:42           ` Linus Torvalds
2000-12-09  4:59             ` Alexander Viro
2000-12-09  8:45               ` Linus Torvalds
2000-12-09  8:56                 ` Linus Torvalds
2000-12-09 10:40                 ` Alexander Viro
2000-12-09 12:56                   ` Andries Brouwer
2000-12-09 13:11                     ` Alexander Viro
2000-12-09 21:25                       ` Mikulas Patocka
2000-12-10  1:11                         ` Linus Torvalds
2000-12-09 17:28                   ` Linus Torvalds
2000-12-09 18:43                     ` Andi Kleen
2000-12-09 14:00                 ` David S. Miller
2000-12-09 15:37       ` David Woodhouse

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox