Re: Warning at mm/truncate.c:740

2016-12-01 Thread Vegard Nossum 
On 10 August 2015 at 11:43, Jan Kara  wrote:
> On Sun 09-08-15 10:49:33, Sasha Levin wrote:
>> I saw the following warning while fuzzing with trinity:
>>
>> [385644.689209] WARNING: CPU: 1 PID: 23536 at mm/truncate.c:740 
>> pagecache_isize_extended+0x124/0x180()
>> [385644.691780] Modules linked in:
>> [385644.692695] CPU: 1 PID: 23536 Comm: trinity-c242 Not tainted 
>> 4.2.0-rc5-next-20150806-sasha-00040-g1b47b00-dirty #2417
>> [385644.695636]  b21300e0 8800ba3cfc40 b1e89dfc 
>> 
>> [385644.708128]  8800ba3cfc80 a8325106 a869fdd4 
>> 88006bbe1f10
>> [385644.710046]  1007 88006bbe1f60 88006bbe1f10 
>> 8803daa965a0
>> [385644.722774] Call Trace:
>> [385644.723591] dump_stack (lib/dump_stack.c:52)
>> [385644.725180] warn_slowpath_common (kernel/panic.c:448)
>> [385644.728983] warn_slowpath_null (kernel/panic.c:482)
>> [385644.730679] pagecache_isize_extended (mm/truncate.c:740 (discriminator 
>> 1))
>> [385644.732630] truncate_setsize (mm/truncate.c:710)
>> [385644.734469] v9fs_vfs_setattr_dotl (fs/9p/v9fs_vfs.h:81 
>> fs/9p/vfs_inode_dotl.c:593)
>> [385644.753009] notify_change (fs/attr.c:270)
>> [385644.754303] do_truncate (fs/open.c:64)
>> [385644.759181] do_sys_ftruncate.constprop.5 (fs/open.c:193)
>> [385644.760669] SyS_ftruncate (fs/open.c:201)
>> [385644.761818] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
>>
>> But I'm not really sure how that happens... truncate_setsize() changes the 
>> inode
>> size before calling pagecache_isize_extended():
>>
>>   i_size_write(inode, newsize);
>>   if (newsize > oldsize)
>>   pagecache_isize_extended(inode, oldsize, newsize);
>>   truncate_pagecache(inode, newsize);
>>
>> And notify_change() is verifying that i_mutex is held:
>>
>>   WARN_ON_ONCE(!mutex_is_locked(>i_mutex));
>>
>> So it doesn't look like a race either.
>
> Well, looking at the code it can be a race which is specific to 9p
> filesystem. It seems to me that 9p can update i_size from
> v9fs_refresh_inode_dotl(). That can be called v9fs_lookup_revalidate()
> without holding i_mutex. Now I'm not sure d_revalidate() can really race
> with truncate on the same inode (whether there isn't something else
> protecting this). Al should know better...

FWIW I'm still hitting this on latest linus/master (4.9.0-rc7+).


Vegard

Re: Warning at mm/truncate.c:740

2016-12-01 Thread Vegard Nossum 
On 10 August 2015 at 11:43, Jan Kara  wrote:
> On Sun 09-08-15 10:49:33, Sasha Levin wrote:
>> I saw the following warning while fuzzing with trinity:
>>
>> [385644.689209] WARNING: CPU: 1 PID: 23536 at mm/truncate.c:740 
>> pagecache_isize_extended+0x124/0x180()
>> [385644.691780] Modules linked in:
>> [385644.692695] CPU: 1 PID: 23536 Comm: trinity-c242 Not tainted 
>> 4.2.0-rc5-next-20150806-sasha-00040-g1b47b00-dirty #2417
>> [385644.695636]  b21300e0 8800ba3cfc40 b1e89dfc 
>> 
>> [385644.708128]  8800ba3cfc80 a8325106 a869fdd4 
>> 88006bbe1f10
>> [385644.710046]  1007 88006bbe1f60 88006bbe1f10 
>> 8803daa965a0
>> [385644.722774] Call Trace:
>> [385644.723591] dump_stack (lib/dump_stack.c:52)
>> [385644.725180] warn_slowpath_common (kernel/panic.c:448)
>> [385644.728983] warn_slowpath_null (kernel/panic.c:482)
>> [385644.730679] pagecache_isize_extended (mm/truncate.c:740 (discriminator 
>> 1))
>> [385644.732630] truncate_setsize (mm/truncate.c:710)
>> [385644.734469] v9fs_vfs_setattr_dotl (fs/9p/v9fs_vfs.h:81 
>> fs/9p/vfs_inode_dotl.c:593)
>> [385644.753009] notify_change (fs/attr.c:270)
>> [385644.754303] do_truncate (fs/open.c:64)
>> [385644.759181] do_sys_ftruncate.constprop.5 (fs/open.c:193)
>> [385644.760669] SyS_ftruncate (fs/open.c:201)
>> [385644.761818] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
>>
>> But I'm not really sure how that happens... truncate_setsize() changes the 
>> inode
>> size before calling pagecache_isize_extended():
>>
>>   i_size_write(inode, newsize);
>>   if (newsize > oldsize)
>>   pagecache_isize_extended(inode, oldsize, newsize);
>>   truncate_pagecache(inode, newsize);
>>
>> And notify_change() is verifying that i_mutex is held:
>>
>>   WARN_ON_ONCE(!mutex_is_locked(>i_mutex));
>>
>> So it doesn't look like a race either.
>
> Well, looking at the code it can be a race which is specific to 9p
> filesystem. It seems to me that 9p can update i_size from
> v9fs_refresh_inode_dotl(). That can be called v9fs_lookup_revalidate()
> without holding i_mutex. Now I'm not sure d_revalidate() can really race
> with truncate on the same inode (whether there isn't something else
> protecting this). Al should know better...

FWIW I'm still hitting this on latest linus/master (4.9.0-rc7+).


Vegard

Re: Warning at mm/truncate.c:740

2015-08-10 Thread Jan Kara 
  Hi,

On Sun 09-08-15 10:49:33, Sasha Levin wrote:
> I saw the following warning while fuzzing with trinity:
> 
> [385644.689209] WARNING: CPU: 1 PID: 23536 at mm/truncate.c:740 
> pagecache_isize_extended+0x124/0x180()
> [385644.691780] Modules linked in:
> [385644.692695] CPU: 1 PID: 23536 Comm: trinity-c242 Not tainted 
> 4.2.0-rc5-next-20150806-sasha-00040-g1b47b00-dirty #2417
> [385644.695636]  b21300e0 8800ba3cfc40 b1e89dfc 
> 
> [385644.708128]  8800ba3cfc80 a8325106 a869fdd4 
> 88006bbe1f10
> [385644.710046]  1007 88006bbe1f60 88006bbe1f10 
> 8803daa965a0
> [385644.722774] Call Trace:
> [385644.723591] dump_stack (lib/dump_stack.c:52)
> [385644.725180] warn_slowpath_common (kernel/panic.c:448)
> [385644.728983] warn_slowpath_null (kernel/panic.c:482)
> [385644.730679] pagecache_isize_extended (mm/truncate.c:740 (discriminator 1))
> [385644.732630] truncate_setsize (mm/truncate.c:710)
> [385644.734469] v9fs_vfs_setattr_dotl (fs/9p/v9fs_vfs.h:81 
> fs/9p/vfs_inode_dotl.c:593)
> [385644.753009] notify_change (fs/attr.c:270)
> [385644.754303] do_truncate (fs/open.c:64)
> [385644.759181] do_sys_ftruncate.constprop.5 (fs/open.c:193)
> [385644.760669] SyS_ftruncate (fs/open.c:201)
> [385644.761818] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
> 
> But I'm not really sure how that happens... truncate_setsize() changes the 
> inode
> size before calling pagecache_isize_extended():
> 
>   i_size_write(inode, newsize);
>   if (newsize > oldsize)
>   pagecache_isize_extended(inode, oldsize, newsize);
>   truncate_pagecache(inode, newsize);
> 
> And notify_change() is verifying that i_mutex is held:
> 
>   WARN_ON_ONCE(!mutex_is_locked(>i_mutex));
> 
> So it doesn't look like a race either.

Well, looking at the code it can be a race which is specific to 9p
filesystem. It seems to me that 9p can update i_size from
v9fs_refresh_inode_dotl(). That can be called v9fs_lookup_revalidate()
without holding i_mutex. Now I'm not sure d_revalidate() can really race
with truncate on the same inode (whether there isn't something else
protecting this). Al should know better...

Honza
-- 
Jan Kara 
SUSE Labs, CR
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: Warning at mm/truncate.c:740

2015-08-10 Thread Jan Kara 
  Hi,

On Sun 09-08-15 10:49:33, Sasha Levin wrote:
 I saw the following warning while fuzzing with trinity:
 
 [385644.689209] WARNING: CPU: 1 PID: 23536 at mm/truncate.c:740 
 pagecache_isize_extended+0x124/0x180()
 [385644.691780] Modules linked in:
 [385644.692695] CPU: 1 PID: 23536 Comm: trinity-c242 Not tainted 
 4.2.0-rc5-next-20150806-sasha-00040-g1b47b00-dirty #2417
 [385644.695636]  b21300e0 8800ba3cfc40 b1e89dfc 
 
 [385644.708128]  8800ba3cfc80 a8325106 a869fdd4 
 88006bbe1f10
 [385644.710046]  1007 88006bbe1f60 88006bbe1f10 
 8803daa965a0
 [385644.722774] Call Trace:
 [385644.723591] dump_stack (lib/dump_stack.c:52)
 [385644.725180] warn_slowpath_common (kernel/panic.c:448)
 [385644.728983] warn_slowpath_null (kernel/panic.c:482)
 [385644.730679] pagecache_isize_extended (mm/truncate.c:740 (discriminator 1))
 [385644.732630] truncate_setsize (mm/truncate.c:710)
 [385644.734469] v9fs_vfs_setattr_dotl (fs/9p/v9fs_vfs.h:81 
 fs/9p/vfs_inode_dotl.c:593)
 [385644.753009] notify_change (fs/attr.c:270)
 [385644.754303] do_truncate (fs/open.c:64)
 [385644.759181] do_sys_ftruncate.constprop.5 (fs/open.c:193)
 [385644.760669] SyS_ftruncate (fs/open.c:201)
 [385644.761818] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
 
 But I'm not really sure how that happens... truncate_setsize() changes the 
 inode
 size before calling pagecache_isize_extended():
 
   i_size_write(inode, newsize);
   if (newsize  oldsize)
   pagecache_isize_extended(inode, oldsize, newsize);
   truncate_pagecache(inode, newsize);
 
 And notify_change() is verifying that i_mutex is held:
 
   WARN_ON_ONCE(!mutex_is_locked(inode-i_mutex));
 
 So it doesn't look like a race either.

Well, looking at the code it can be a race which is specific to 9p
filesystem. It seems to me that 9p can update i_size from
v9fs_refresh_inode_dotl(). That can be called v9fs_lookup_revalidate()
without holding i_mutex. Now I'm not sure d_revalidate() can really race
with truncate on the same inode (whether there isn't something else
protecting this). Al should know better...

Honza
-- 
Jan Kara j...@suse.com
SUSE Labs, CR
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/