Re: [PATCH] __free_pages_ok oops

[Andrew Morton <akpm@zip.com.au>]

Andrea Arcangeli wrote:
> 
> > Good to hear.  But what about the weird corner-case in truncate_complete_page(),
> > where a mapped page is not successfully released, and is converted into
> > an anon buffercache page?  It seems that a combination of sendfile
> > and truncate could result in one of those pages being subject to
> > final release in BH context?
> 
> Such a page is not in the lru so it doesn't matter.

static void truncate_complete_page(struct page *page)
{
        /* Leave it on the LRU if it gets converted into anonymous buffers */
        if (!page->buffers || do_flushpage(page, 0))
                lru_cache_del(page);

If the page has buffers, and do_flushpage() fails, what happens?

> As said in the previous email, from another point of view, the only
> thing that can be still in the lru during __free_pages_ok is an
> anonymous page. truncate_complete_page cannot run on an anonymous page.
> Anonymous pages cannot be truncated.

truncate_complete_page() can, in rare circumstances, take a page
which was in both the pagecache and on LRU, and leave it purely
on LRU.  And because that page *used* to be in pagecache, it
could be undergoing sendfile.

Or I'm missing something.  Did something change?

-