: ufs: ufs_get_locked_patch race fix

As discussed earlier:
http://lkml.org/lkml/2006/6/28/136
this patch fixes such issue:
`ufs_get_locked_page' takes page from cache
after that vmtruncate' takes page and deletes it from cache ufs_get_locked_page' locks page, and reports about EIO error.

Also because of find_lock_page always return valid page or NULL, we have no need check it if page not NULL.

Signed-off-by Evgeniy Dushistov <[email protected]>

---

Index: linux-2.6.18-rc2-mm1/fs/ufs/util.c
===================================================================

fs/ufs/util.c +1 -0

@@ -257,6 +257,7 @@ try_again:
 		page = read_cache_page(mapping, index,
 				       (filler_t*)mapping->a_ops->readpage,
 				       NULL);
+
 		if (IS_ERR(page)) {
 			printk(KERN_ERR "ufs_change_blocknr: "
 			       "read_cache_page error: ino %lu, index: %lu\n",

@@ -266,6 +267,13 @@ try_again:
 
 		lock_page(page);
 

Quoted 33 lines · On Mon, 31 Jul 2006 16:57:02 +0400 Evgeniy Dushistov <[email protected]> wrote:

As discussed earlier:
http://lkml.org/lkml/2006/6/28/136
this patch fixes such issue:
`ufs_get_locked_page' takes page from cache
after that vmtruncate' takes page and deletes it from cache ufs_get_locked_page' locks page, and reports about EIO error.

Also because of find_lock_page always return valid page or NULL, we have no need check it if page not NULL.

Signed-off-by Evgeniy Dushistov <[email protected]>

---

Index: linux-2.6.18-rc2-mm1/fs/ufs/util.c
===================================================================

fs/ufs/util.c +1 -0

@@ -257,6 +257,7 @@ try_again:
 		page = read_cache_page(mapping, index,
 				       (filler_t*)mapping->a_ops->readpage,
 				       NULL);
+
 		if (IS_ERR(page)) {
 			printk(KERN_ERR "ufs_change_blocknr: "
 			       "read_cache_page error: ino %lu, index: %lu\n",

@@ -266,6 +267,13 @@ try_again:
 
 		lock_page(page);
 

fs/ufs/util.c try_again: · line 279

Quoted 10 lines

fs/ufs/util.c +7 -0

+		if (unlikely(page->mapping != mapping ||
+			     page->index != index)) {
+			unlock_page(page);
+			page_cache_release(page);
+			goto try_again;
+		}
+
 		if (!PageUptodate(page) || PageError(page)) {
 			unlock_page(page);
 			page_cache_release(page);

Looks good to me.

Is there any need to be checking ->index? Normally we simply use the sequence:

	lock_page(page);
	if (page->mapping == NULL)
		/* truncate got there first */

to handle this case.

On Mon, 31 Jul 2006 16:57:02 +0400
Evgeniy Dushistov <[email protected]> wrote:

Looks good to me.

Is there any need to be checking ->index? Normally we simply use the sequence:

	lock_page(page);
	if (page->mapping == NULL)
		/* truncate got there first */

to handle this case.

Quoted 12 lines · Andrew Morton

On Mon, 31 Jul 2006 16:57:02 +0400
Evgeniy Dushistov <[email protected]> wrote:

Looks good to me.

Is there any need to be checking ->index? Normally we simply use the sequence:

	lock_page(page);
	if (page->mapping == NULL)
		/* truncate got there first */

Quoted 1 line

to handle this case.

Yes, I made it in analogy with `find_lock_page' and missed fact that if we increment usage counter of page, we have no need to check page->index.

Need another patch?

I'm not sure that the `goto repeat' is needed if truncate got there first, really - if truncate took the page down then it's now outside i_size and shouldn't be coming back.

If the page _can_ come back then this code is all rather problematic. Because this means that the page can come back (via an extending write()) one nanosecond after ufs_get_locked_page() returns NULL. Won't the callers of ufs_get_locked_page() get confused by that?