WARNING followed by splat when running rewrite test program

[OGAWA Hirofumi]

"Darrick J. Wong" <darrick.wong at oracle.com> writes:

> Hi,

Hi,

> I lazily "ported" tux3 to 3.15-rc3 and then I tried running the stable page
> test program[1] on a tux3 filesystem with mmap enabled, and got a splat in
> dmesg.
>
> # gcc -o wac wac.c
> # mount /dev/path/to/a/tux3fs /mnt
> # ./wac -l 65536 -n 32 -m 32 -f -r /mnt/victimfile
> <wait a few seconds>
> <kaboom>
>
> Looks like first we get a warning, followed some time later by an actual BUG.
> If I omit the "-m32" above to shut off mmap writes, it's fine.  Actually, it
> beats btrfs and ext4 by a wide margin in terms of write speed.
>
> [1] http://djwong.org/docs/wac.c 

With quick debugging, this seems to be race of MS_INVALIDATE and page
fault with pagefork (page/buffers COW of tux3).

And for now, I'm trying to support mmap without kernel core patch
though. This race probably have to patch to kernel core.

The callers of ->page_mkwrite() handler doesn't expect to change the
passed page, but tux3 has to COW for stable page and our transaction
handling.

Well, anyway, this hack patch (with allow to change page in
->page_mkwrite()) seems to fix. I'll see more details of this race,
trying without kernel core patch a bit (likely to fail).

Thanks.

[BTW, I'm trying to reproduce bug of tests/generic/299, but not succeed yet.]

Signed-off-by: OGAWA Hirofumi <hirofumi at mail.parknet.co.jp>
---

 fs/tux3/filemap_mmap.c |    5 ++++-
 mm/memory.c            |    2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff -puN fs/tux3/filemap_mmap.c~page-cow fs/tux3/filemap_mmap.c
--- tux3fs/fs/tux3/filemap_mmap.c~page-cow	2014-05-03 11:43:29.504133425 +0900
+++ tux3fs-hirofumi/fs/tux3/filemap_mmap.c	2014-05-03 11:43:29.508133415 +0900
@@ -214,10 +214,13 @@ retry:
 
 	change_end_atomic_nested(sb, ptr);
 	/* FIXME: caller doesn't know about pagefork */
+#if 0
 	unlock_page(clone);
 	page_cache_release(clone);
-//	ret = VM_FAULT_RETRY;
 	ret = 0;
+#else
+	ret = VM_FAULT_LOCKED;
+#endif
 #endif
 out:
 	up_read(&tux_inode(inode)->truncate_lock);
diff -puN mm/memory.c~page-cow mm/memory.c
--- tux3fs/mm/memory.c~page-cow	2014-05-03 11:43:29.508133415 +0900
+++ tux3fs-hirofumi/mm/memory.c	2014-05-03 11:43:29.520133387 +0900
@@ -2694,6 +2694,7 @@ static int do_wp_page(struct mm_struct *
 				ret = tmp;
 				goto unwritable_page;
 			}
+			old_page = vmf.page;
 			if (unlikely(!(tmp & VM_FAULT_LOCKED))) {
 				lock_page(old_page);
 				if (!old_page->mapping) {
@@ -3388,6 +3389,7 @@ static int __do_fault(struct mm_struct *
 					ret = tmp;
 					goto unwritable_page;
 				}
+				page = vmf.page;
 				if (unlikely(!(tmp & VM_FAULT_LOCKED))) {
 					lock_page(page);
 					if (!page->mapping) {
_

-- 
OGAWA Hirofumi <hirofumi at mail.parknet.co.jp>