Commit 3e1199dc authored by Milosz Tanski's avatar Milosz Tanski Committed by David Howells

FS-Cache: refcount becomes corrupt under vma pressure.

In rare cases under heavy VMA pressure the ref count for a fscache cookie
becomes corrupt. In this case we decrement ref count even if we fail before
incrementing the refcount.

FS-Cache: Assertion failed bnode-eca5f9c6/syslog
0 > 0 is false
------------[ cut here ]------------
kernel BUG at fs/fscache/cookie.c:519!
invalid opcode: 0000 [#1] SMP
Call Trace:
[<ffffffffa01ba060>] __fscache_relinquish_cookie+0x50/0x220 [fscache]
[<ffffffffa02d64ce>] ceph_fscache_unregister_inode_cookie+0x3e/0x50 [ceph]
[<ffffffffa02ae1d3>] ceph_destroy_inode+0x33/0x200 [ceph]
[<ffffffff811cf67e>] ? __fsnotify_inode_delete+0xe/0x10
[<ffffffff811a9e0c>] destroy_inode+0x3c/0x70
[<ffffffff811a9f51>] evict+0x111/0x180
[<ffffffff811aa763>] iput+0x103/0x190
[<ffffffff811a5de8>] __dentry_kill+0x1c8/0x220
[<ffffffff811a5f31>] shrink_dentry_list+0xf1/0x250
[<ffffffff811a762c>] prune_dcache_sb+0x4c/0x60
[<ffffffff811930af>] super_cache_scan+0xff/0x170
[<ffffffff8113d7a0>] shrink_slab_node+0x140/0x2c0
[<ffffffff8113f2da>] shrink_slab+0x8a/0x130
[<ffffffff81142572>] balance_pgdat+0x3e2/0x5d0
[<ffffffff811428ca>] kswapd+0x16a/0x4a0
[<ffffffff810a43f0>] ? __wake_up_sync+0x20/0x20
[<ffffffff81142760>] ? balance_pgdat+0x5d0/0x5d0
[<ffffffff81083e09>] kthread+0xc9/0xe0
[<ffffffff81010000>] ? ftrace_raw_event_xen_mmu_release_ptpage+0x70/0x90
[<ffffffff81083d40>] ? flush_kthread_worker+0xb0/0xb0
[<ffffffff8159f63c>] ret_from_fork+0x7c/0xb0
[<ffffffff81083d40>] ? flush_kthread_worker+0xb0/0xb0
RIP [<ffffffffa01b984b>] __fscache_disable_cookie+0x1db/0x210 [fscache]
RSP <ffff8803bc85f9b8>
---[ end trace 254d0d7c74a01f25 ]---
Signed-off-by: default avatarMilosz Tanski <milosz@adfin.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
parent 920bce20
...@@ -198,7 +198,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie) ...@@ -198,7 +198,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
{ {
struct fscache_operation *op; struct fscache_operation *op;
struct fscache_object *object; struct fscache_object *object;
bool wake_cookie; bool wake_cookie = false;
_enter("%p", cookie); _enter("%p", cookie);
...@@ -228,15 +228,16 @@ int __fscache_attr_changed(struct fscache_cookie *cookie) ...@@ -228,15 +228,16 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
__fscache_use_cookie(cookie); __fscache_use_cookie(cookie);
if (fscache_submit_exclusive_op(object, op) < 0) if (fscache_submit_exclusive_op(object, op) < 0)
goto nobufs; goto nobufs_dec;
spin_unlock(&cookie->lock); spin_unlock(&cookie->lock);
fscache_stat(&fscache_n_attr_changed_ok); fscache_stat(&fscache_n_attr_changed_ok);
fscache_put_operation(op); fscache_put_operation(op);
_leave(" = 0"); _leave(" = 0");
return 0; return 0;
nobufs: nobufs_dec:
wake_cookie = __fscache_unuse_cookie(cookie); wake_cookie = __fscache_unuse_cookie(cookie);
nobufs:
spin_unlock(&cookie->lock); spin_unlock(&cookie->lock);
kfree(op); kfree(op);
if (wake_cookie) if (wake_cookie)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment