projects
/
linux-2.6-block.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
920bce2
)
FS-Cache: refcount becomes corrupt under vma pressure.
author
Milosz Tanski
<milosz@adfin.com>
Wed, 13 Aug 2014 16:58:26 +0000
(12:58 -0400)
committer
David Howells
<dhowells@redhat.com>
Wed, 17 Sep 2014 21:41:40 +0000
(22:41 +0100)
In rare cases under heavy VMA pressure the ref count for a fscache cookie
becomes corrupt. In this case we decrement ref count even if we fail before
incrementing the refcount.
FS-Cache: Assertion failed bnode-
eca5f9c6
/syslog
0 > 0 is false
------------[ cut here ]------------
kernel BUG at fs/fscache/cookie.c:519!
invalid opcode: 0000 [#1] SMP
Call Trace:
[<
ffffffffa01ba060
>] __fscache_relinquish_cookie+0x50/0x220 [fscache]
[<
ffffffffa02d64ce
>] ceph_fscache_unregister_inode_cookie+0x3e/0x50 [ceph]
[<
ffffffffa02ae1d3
>] ceph_destroy_inode+0x33/0x200 [ceph]
[<
ffffffff811cf67e
>] ? __fsnotify_inode_delete+0xe/0x10
[<
ffffffff811a9e0c
>] destroy_inode+0x3c/0x70
[<
ffffffff811a9f51
>] evict+0x111/0x180
[<
ffffffff811aa763
>] iput+0x103/0x190
[<
ffffffff811a5de8
>] __dentry_kill+0x1c8/0x220
[<
ffffffff811a5f31
>] shrink_dentry_list+0xf1/0x250
[<
ffffffff811a762c
>] prune_dcache_sb+0x4c/0x60
[<
ffffffff811930af
>] super_cache_scan+0xff/0x170
[<
ffffffff8113d7a0
>] shrink_slab_node+0x140/0x2c0
[<
ffffffff8113f2da
>] shrink_slab+0x8a/0x130
[<
ffffffff81142572
>] balance_pgdat+0x3e2/0x5d0
[<
ffffffff811428ca
>] kswapd+0x16a/0x4a0
[<
ffffffff810a43f0
>] ? __wake_up_sync+0x20/0x20
[<
ffffffff81142760
>] ? balance_pgdat+0x5d0/0x5d0
[<
ffffffff81083e09
>] kthread+0xc9/0xe0
[<
ffffffff81010000
>] ? ftrace_raw_event_xen_mmu_release_ptpage+0x70/0x90
[<
ffffffff81083d40
>] ? flush_kthread_worker+0xb0/0xb0
[<
ffffffff8159f63c
>] ret_from_fork+0x7c/0xb0
[<
ffffffff81083d40
>] ? flush_kthread_worker+0xb0/0xb0
RIP [<
ffffffffa01b984b
>] __fscache_disable_cookie+0x1db/0x210 [fscache]
RSP <
ffff8803bc85f9b8
>
---[ end trace
254d0d7c74a01f25
]---
Signed-off-by: Milosz Tanski <milosz@adfin.com>
Signed-off-by: David Howells <dhowells@redhat.com>
fs/fscache/page.c
patch
|
blob
|
blame
|
history
diff --git
a/fs/fscache/page.c
b/fs/fscache/page.c
index 781ac7b0b53e71ea5339303960032df125ddaf37..de33b3fccca650da99ee850597d5aef437b3a6fe 100644
(file)
--- a/
fs/fscache/page.c
+++ b/
fs/fscache/page.c
@@
-198,7
+198,7
@@
int __fscache_attr_changed(struct fscache_cookie *cookie)
{
struct fscache_operation *op;
struct fscache_object *object;
{
struct fscache_operation *op;
struct fscache_object *object;
- bool wake_cookie;
+ bool wake_cookie
= false
;
_enter("%p", cookie);
_enter("%p", cookie);
@@
-228,15
+228,16
@@
int __fscache_attr_changed(struct fscache_cookie *cookie)
__fscache_use_cookie(cookie);
if (fscache_submit_exclusive_op(object, op) < 0)
__fscache_use_cookie(cookie);
if (fscache_submit_exclusive_op(object, op) < 0)
- goto nobufs;
+ goto nobufs
_dec
;
spin_unlock(&cookie->lock);
fscache_stat(&fscache_n_attr_changed_ok);
fscache_put_operation(op);
_leave(" = 0");
return 0;
spin_unlock(&cookie->lock);
fscache_stat(&fscache_n_attr_changed_ok);
fscache_put_operation(op);
_leave(" = 0");
return 0;
-nobufs:
+nobufs
_dec
:
wake_cookie = __fscache_unuse_cookie(cookie);
wake_cookie = __fscache_unuse_cookie(cookie);
+nobufs:
spin_unlock(&cookie->lock);
kfree(op);
if (wake_cookie)
spin_unlock(&cookie->lock);
kfree(op);
if (wake_cookie)