Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59a16ead authored by Hugh Dickins's avatar Hugh Dickins Committed by Linus Torvalds
Browse files

tmpfs: fix spurious ENOSPC when racing with unswap 



Testing the shmem_swaplist replacements for igrab() revealed another bug:
writes to /dev/loop0 on a tmpfs file which fills its filesystem were
sometimes failing with "Buffer I/O error"s.

These came from ENOSPC failures of shmem_getpage(), when racing with
swapoff: the same could happen when racing with another shmem_getpage(),
pulling the page in from swap in between our find_lock_page() and our
taking the info->lock (though not in the single-threaded loop case).

This is unacceptable, and surprising that I've not noticed it before:
it dates back many years, but (presumably) was made a lot easier to
reproduce in 2.6.36, which sited a page preallocation in the race window.

Fix it by rechecking the page cache before settling on an ENOSPC error.

Signed-off-by: default avatarHugh Dickins <hughd@google.com>
Cc: Konstantin Khlebnikov <khlebnikov@openvz.org>
Cc: <stable@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 778dd893

mm/shmem.c

+22 −10
Original line number Diff line number Diff line
@@ -1407,20 +1407,14 @@ static int shmem_getpage(struct inode *inode, unsigned long idx, 
		if (sbinfo->max_blocks) {

			if (percpu_counter_compare(&sbinfo->used_blocks,

						sbinfo->max_blocks) >= 0 ||

			    shmem_acct_block(info->flags)) {

				spin_unlock(&info->lock);

				error = -ENOSPC;

				goto failed;

			}

			    shmem_acct_block(info->flags))

				goto nospace;

			percpu_counter_inc(&sbinfo->used_blocks);

			spin_lock(&inode->i_lock);

			inode->i_blocks += BLOCKS_PER_PAGE;

			spin_unlock(&inode->i_lock);

		} else if (shmem_acct_block(info->flags)) {

			spin_unlock(&info->lock);

			error = -ENOSPC;

			goto failed;

		}

		} else if (shmem_acct_block(info->flags))

			goto nospace;



		if (!filepage) {

			int ret;
@@ -1500,6 +1494,24 @@ static int shmem_getpage(struct inode *inode, unsigned long idx, 
	error = 0;

	goto out;



nospace:

	/*

	 * Perhaps the page was brought in from swap between find_lock_page

	 * and taking info->lock?  We allow for that at add_to_page_cache_lru,

	 * but must also avoid reporting a spurious ENOSPC while working on a

	 * full tmpfs.  (When filepage has been passed in to shmem_getpage, it

	 * is already in page cache, which prevents this race from occurring.)

	 */

	if (!filepage) {

		struct page *page = find_get_page(mapping, idx);

		if (page) {

			spin_unlock(&info->lock);

			page_cache_release(page);

			goto repeat;

		}

	}

	spin_unlock(&info->lock);

	error = -ENOSPC;

failed:

	if (*pagep != filepage) {

		unlock_page(filepage);