Commit 2aa15890 authored by Miklos Szeredi's avatar Miklos Szeredi Committed by Linus Torvalds
Browse files

mm: prevent concurrent unmap_mapping_range() on the same inode 



Michael Leun reported that running parallel opens on a fuse filesystem
can trigger a "kernel BUG at mm/truncate.c:475"

Gurudas Pai reported the same bug on NFS.

The reason is, unmap_mapping_range() is not prepared for more than
one concurrent invocation per inode.  For example:

  thread1: going through a big range, stops in the middle of a vma and
     stores the restart address in vm_truncate_count.

  thread2: comes in with a small (e.g. single page) unmap request on
     the same vma, somewhere before restart_address, finds that the
     vma was already unmapped up to the restart address and happily
     returns without doing anything.

Another scenario would be two big unmap requests, both having to
restart the unmapping and each one setting vm_truncate_count to its
own value.  This could go on forever without any of them being able to
finish.

Truncate and hole punching already serialize with i_mutex.  Other
callers of unmap_mapping_range() do not, and it's difficult to get
i_mutex protection for all callers.  In particular ->d_revalidate(),
which calls invalidate_inode_pages2_range() in fuse, may be called
with or without i_mutex.

This patch adds a new mutex to 'struct address_space' to prevent
running multiple concurrent unmap_mapping_range() on the same mapping.

[ We'll hopefully get rid of all this with the upcoming mm
  preemptibility series by Peter Zijlstra, the "mm: Remove i_mmap_mutex
  lockbreak" patch in particular.  But that is for 2.6.39 ]

Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
Reported-by: default avatarMichael Leun <lkml20101129@newton.leun.net>
Reported-by: default avatarGurudas Pai <gurudas.pai@oracle.com>
Tested-by: default avatarGurudas Pai <gurudas.pai@oracle.com>
Acked-by: default avatarHugh Dickins <hughd@google.com>
Cc: stable@kernel.org
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 78794b2c

fs/gfs2/main.c

+1 −8
Original line number Diff line number Diff line
@@ -59,14 +59,7 @@ static void gfs2_init_gl_aspace_once(void *foo) 
	struct address_space *mapping = (struct address_space *)(gl + 1);



	gfs2_init_glock_once(gl);

	memset(mapping, 0, sizeof(*mapping));

	INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);

	spin_lock_init(&mapping->tree_lock);

	spin_lock_init(&mapping->i_mmap_lock);

	INIT_LIST_HEAD(&mapping->private_list);

	spin_lock_init(&mapping->private_lock);

	INIT_RAW_PRIO_TREE_ROOT(&mapping->i_mmap);

	INIT_LIST_HEAD(&mapping->i_mmap_nonlinear);

	address_space_init_once(mapping);

}



/**

fs/inode.c

+15 −7
Original line number Diff line number Diff line
@@ -295,6 +295,20 @@ static void destroy_inode(struct inode *inode) 
		call_rcu(&inode->i_rcu, i_callback);

}



void address_space_init_once(struct address_space *mapping)

{

	memset(mapping, 0, sizeof(*mapping));

	INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);

	spin_lock_init(&mapping->tree_lock);

	spin_lock_init(&mapping->i_mmap_lock);

	INIT_LIST_HEAD(&mapping->private_list);

	spin_lock_init(&mapping->private_lock);

	INIT_RAW_PRIO_TREE_ROOT(&mapping->i_mmap);

	INIT_LIST_HEAD(&mapping->i_mmap_nonlinear);

	mutex_init(&mapping->unmap_mutex);

}

EXPORT_SYMBOL(address_space_init_once);



/*

 * These are initializations that only need to be done

 * once, because the fields are idempotent across use
@@ -308,13 +322,7 @@ void inode_init_once(struct inode *inode) 
	INIT_LIST_HEAD(&inode->i_devices);

	INIT_LIST_HEAD(&inode->i_wb_list);

	INIT_LIST_HEAD(&inode->i_lru);

	INIT_RADIX_TREE(&inode->i_data.page_tree, GFP_ATOMIC);

	spin_lock_init(&inode->i_data.tree_lock);

	spin_lock_init(&inode->i_data.i_mmap_lock);

	INIT_LIST_HEAD(&inode->i_data.private_list);

	spin_lock_init(&inode->i_data.private_lock);

	INIT_RAW_PRIO_TREE_ROOT(&inode->i_data.i_mmap);

	INIT_LIST_HEAD(&inode->i_data.i_mmap_nonlinear);

	address_space_init_once(&inode->i_data);

	i_size_ordered_init(inode);

#ifdef CONFIG_FSNOTIFY

	INIT_HLIST_HEAD(&inode->i_fsnotify_marks);

fs/nilfs2/btnode.c

+0 −5
Original line number Diff line number Diff line
@@ -35,11 +35,6 @@ 
#include "btnode.h"





void nilfs_btnode_cache_init_once(struct address_space *btnc)

{

	nilfs_mapping_init_once(btnc);

}



static const struct address_space_operations def_btnode_aops = {

	.sync_page		= block_sync_page,

};

fs/nilfs2/btnode.h

+0 −1
Original line number Diff line number Diff line
@@ -37,7 +37,6 @@ struct nilfs_btnode_chkey_ctxt { 
	struct buffer_head *newbh;

};



void nilfs_btnode_cache_init_once(struct address_space *);

void nilfs_btnode_cache_init(struct address_space *, struct backing_dev_info *);

void nilfs_btnode_cache_clear(struct address_space *);

struct buffer_head *nilfs_btnode_create_block(struct address_space *btnc,

fs/nilfs2/mdt.c

+2 −2
Original line number Diff line number Diff line
@@ -454,9 +454,9 @@ int nilfs_mdt_setup_shadow_map(struct inode *inode, 
	struct backing_dev_info *bdi = inode->i_sb->s_bdi;



	INIT_LIST_HEAD(&shadow->frozen_buffers);

	nilfs_mapping_init_once(&shadow->frozen_data);

	address_space_init_once(&shadow->frozen_data);

	nilfs_mapping_init(&shadow->frozen_data, bdi, &shadow_map_aops);

	nilfs_mapping_init_once(&shadow->frozen_btnodes);

	address_space_init_once(&shadow->frozen_btnodes);

	nilfs_mapping_init(&shadow->frozen_btnodes, bdi, &shadow_map_aops);

	mi->mi_shadow = shadow;

	return 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE