Commit 5f30fc94 authored Mar 03, 2014 by Hugh Dickins Committed by Linus Torvalds Mar 04, 2014

lib/radix-tree.c: swapoff tmpfs radix_tree: remember to rcu_read_unlock



Running fsx on tmpfs with concurrent memhog-swapoff-swapon, lots of

  BUG: sleeping function called from invalid context at kernel/fork.c:606
  in_atomic(): 0, irqs_disabled(): 0, pid: 1394, name: swapoff
  1 lock held by swapoff/1394:
   #0:  (rcu_read_lock){.+.+.+}, at: [<ffffffff812520a1>] radix_tree_locate_item+0x1f/0x2b6

followed by

  ================================================
  [ BUG: lock held when returning to user space! ]
  3.14.0-rc1 #3 Not tainted
  ------------------------------------------------
  swapoff/1394 is leaving the kernel with locks still held!
  1 lock held by swapoff/1394:
   #0:  (rcu_read_lock){.+.+.+}, at: [<ffffffff812520a1>] radix_tree_locate_item+0x1f/0x2b6

after which the system recovered nicely.

Whoops, I long ago forgot the rcu_read_unlock() on one unlikely branch.

Fixes e504f3fd ("tmpfs radix_tree: locate_item to speed up swapoff")

Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 3b7a6418

lib/radix-tree.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1253,8 +1253,10 @@ unsigned long radix_tree_locate_item(struct radix_tree_root root, void item)

	node = indirect_to_ptr(node);		node = indirect_to_ptr(node);
	max_index = radix_tree_maxindex(node->height);		max_index = radix_tree_maxindex(node->height);
	if (cur_index > max_index)		if (cur_index > max_index) {
			rcu_read_unlock();
	break;		break;
			}

	cur_index = __locate(node, item, cur_index, &found_index);		cur_index = __locate(node, item, cur_index, &found_index);
	rcu_read_unlock();		rcu_read_unlock();

Admin message