• Rongwei Wang's avatar
    mm, thp: lock filemap when truncating page cache · 55fc0d91
    Rongwei Wang authored
    Patch series "fix two bugs for file THP".
    
    This patch (of 2):
    
    Transparent huge page has supported read-only non-shmem files.  The
    file- backed THP is collapsed by khugepaged and truncated when written
    (for shared libraries).
    
    However, there is a race when multiple writers truncate the same page
    cache concurrently.
    
    In that case, subpage(s) of file THP can be revealed by find_get_entry
    in truncate_inode_pages_range, which will trigger PageTail BUG_ON in
    truncate_inode_page, as follows:
    
        page:000000009e420ff2 refcount:1 mapcount:0 mapping:0000000000000000 index:0x7ff pfn:0x50c3ff
        head:0000000075ff816d order:9 compound_mapcount:0 compound_pincount:0
        flags: 0x37fffe0000010815(locked|uptodate|lru|arch_1|head)
        raw: 37fffe0000000000 fffffe0013108001 dead000000000122 dead000000000400
        raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
        head: 37fffe0000010815 fffffe001066bd48 ffff000404183c20 0000000000000000
        head: 0000000000000600 0000000000000000 00000001ffffffff ffff000c0345a000
        page dumped because: VM_BUG_ON_PAGE(PageTail(page))
        ------------[ cut here ]------------
        kernel BUG at mm/truncate.c:213!
        Internal error: Oops - BUG: 0 [#1] SMP
        Modules linked in: xfs(E) libcrc32c(E) rfkill(E) ...
        CPU: 14 PID: 11394 Comm: check_madvise_d Kdump: ...
        Hardware name: ECS, BIOS 0.0.0 02/06/2015
        pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
        Call trace:
         truncate_inode_page+0x64/0x70
         truncate_inode_pages_range+0x550/0x7e4
         truncate_pagecache+0x58/0x80
         do_dentry_open+0x1e4/0x3c0
         vfs_open+0x38/0x44
         do_open+0x1f0/0x310
         path_openat+0x114/0x1dc
         do_filp_open+0x84/0x134
         do_sys_openat2+0xbc/0x164
         __arm64_sys_openat+0x74/0xc0
         el0_svc_common.constprop.0+0x88/0x220
         do_el0_svc+0x30/0xa0
         el0_svc+0x20/0x30
         el0_sync_handler+0x1a4/0x1b0
         el0_sync+0x180/0x1c0
        Code: aa0103e0 900061e1 910ec021 9400d300 (d4210000)
    
    This patch mainly to lock filemap when one enter truncate_pagecache(),
    avoiding truncating the same page cache concurrently.
    
    Link: https://lkml.kernel.org/r/20211025092134.18562-1-rongwei.wang@linux.alibaba.com
    Link: https://lkml.kernel.org/r/20211025092134.18562-2-rongwei.wang@linux.alibaba.com
    Fixes: eb6ecbed ("mm, thp: relax the VM_DENYWRITE constraint on file-backed THPs")
    Signed-off-by: default avatarXu Yu <xuyu@linux.alibaba.com>
    Signed-off-by: default avatarRongwei Wang <rongwei.wang@linux.alibaba.com>
    Suggested-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
    Tested-by: default avatarSong Liu <song@kernel.org>
    Cc: Collin Fijalkovich <cfijalkovich@google.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Mike Kravetz <mike.kravetz@oracle.com>
    Cc: William Kucharski <william.kucharski@oracle.com>
    Cc: Yang Shi <shy828301@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    55fc0d91
open.c 34.3 KB