Re: [PATCH] mm: non-atomically mark page accessed during page cache allocation where possible -fix

[Andrew Morton]

On Tue, 20 May 2014 16:49:00 +0100 Mel Gorman <mgorman@xxxxxxx> wrote:

> Prabhakar Lad reported the following problem
> 
>   I see following issue on DA850 evm,
>   git bisect points me to
>   commit id: 975c3a671f11279441006a29a19f55ccc15fb320
>   ( mm: non-atomically mark page accessed during page cache allocation
>   where possible)
> 
>   Unable to handle kernel paging request at virtual address 30e03501
>   pgd = c68cc000
>   [30e03501] *pgd=00000000
>   Internal error: Oops: 1 [#1] PREEMPT ARM
>   Modules linked in:
>   CPU: 0 PID: 1015 Comm: network.sh Not tainted 3.15.0-rc5-00323-g975c3a6 #9
>   task: c70c4e00 ti: c73d0000 task.ti: c73d0000
>   PC is at init_page_accessed+0xc/0x24
>   LR is at shmem_write_begin+0x54/0x60
>   pc : [<c0088aa0>]    lr : [<c00923e8>]    psr: 20000013
>   sp : c73d1d90  ip : c73d1da0  fp : c73d1d9c
>   r10: c73d1dec  r9 : 00000000  r8 : 00000000
>   r7 : c73d1e6c  r6 : c694d7bc  r5 : ffffffe4  r4 : c73d1dec
>   r3 : c73d0000  r2 : 00000001  r1 : 00000000  r0 : 30e03501
>   Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
>   Control: 0005317f  Table: c68cc000  DAC: 00000015
>   Process network.sh (pid: 1015, stack limit = 0xc73d01c0)
> 
> pagep is set but not pointing to anywhere valid as it's an uninitialised
> stack variable. This patch is a fix to
> mm-non-atomically-mark-page-accessed-during-page-cache-allocation-where-possible.patch
> 
> ...
>
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -2459,7 +2459,7 @@ ssize_t generic_perform_write(struct file *file,
>  		flags |= AOP_FLAG_UNINTERRUPTIBLE;
>  
>  	do {
> -		struct page *page;
> +		struct page *page = NULL;
>  		unsigned long offset;	/* Offset into pagecache page */
>  		unsigned long bytes;	/* Bytes to write to page */
>  		size_t copied;		/* Bytes copied from user */

Well not really.  generic_perform_write() only touches *page if
->write_begin() returned "success", which is reasonable behavior.

I'd say you mucked up shmem_write_begin() - it runs
init_page_accessed() even if shmem_getpage() returned an error.  It
shouldn't be doing that.

This?

From: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Subject: mm/shmem.c: don't run init_page_accessed() against an uninitialised pointer

If shmem_getpage() returned an error then it didn't necessarily initialise
*pagep.  So shmem_write_begin() shouldn't be playing with *pagep in this
situation.

Fixes an oops when "mm: non-atomically mark page accessed during page
cache allocation where possible" (quite reasonably) left *pagep
uninitialized.

Reported-by: Prabhakar Lad <prabhakar.csengg@xxxxxxxxx>
Cc: Johannes Weiner <hannes@xxxxxxxxxxx>
Cc: Vlastimil Babka <vbabka@xxxxxxx>
Cc: Jan Kara <jack@xxxxxxx>
Cc: Michal Hocko <mhocko@xxxxxxx>
Cc: Hugh Dickins <hughd@xxxxxxxxxx>
Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Cc: Dave Hansen <dave.hansen@xxxxxxxxx>
Cc: Mel Gorman <mgorman@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---

 mm/shmem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff -puN mm/shmem.c~mm-non-atomically-mark-page-accessed-during-page-cache-allocation-where-possiblefix-2 mm/shmem.c
--- a/mm/shmem.c~mm-non-atomically-mark-page-accessed-during-page-cache-allocation-where-possiblefix-2
+++ a/mm/shmem.c
@@ -1376,7 +1376,7 @@ shmem_write_begin(struct file *file, str
 	struct inode *inode = mapping->host;
 	pgoff_t index = pos >> PAGE_CACHE_SHIFT;
 	ret = shmem_getpage(inode, index, pagep, SGP_WRITE, NULL);
-	if (*pagep)
+	if (ret == 0 && *pagep)
 		init_page_accessed(*pagep);
 	return ret;
 }
_

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/