[PATCH] tmpfs truncation fix

From: Hugh Dickins <hugh@veritas.com>

Recent testing has shown that swapoff can sneak a page back into the
tmpfs page cache after truncate_inode_pages has cleaned it, before
shmem_truncate resets next_index to stop that: BUG_ON(inode->i_blocks)
in shmem_delete_inode.  So call truncate_inode_pages again to be safe.

mm/shmem.c

@@ -486,6 +486,16 @@ static void shmem_truncate(struct inode *inode)
 	}
 done2:
 	BUG_ON(info->swapped > info->next_index);
+	if (inode->i_mapping->nrpages) {
+		/*
+		 * Call truncate_inode_pages again: racing shmem_unuse_inode
+		 * may have swizzled a page in from swap since vmtruncate or
+		 * generic_delete_inode did it, before we lowered next_index.
+		 */
+		spin_unlock(&info->lock);
+		truncate_inode_pages(inode->i_mapping, inode->i_size);
+		spin_lock(&info->lock);
+	}
 	shmem_recalc_inode(inode);
 	spin_unlock(&info->lock);
 }