Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp2003134imu; Fri, 14 Dec 2018 04:20:35 -0800 (PST) X-Google-Smtp-Source: AFSGD/XgTCY8OJEEc6YKXjwW3m3iBFLrNmSS0g6+owcskEXXJ4zZDcAbAfxyjyUW9+tF1Hl0v/4c X-Received: by 2002:a62:e0d8:: with SMTP id d85mr2594742pfm.214.1544790035405; Fri, 14 Dec 2018 04:20:35 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1544790035; cv=none; d=google.com; s=arc-20160816; b=XEmbGDleP3S7HTrgEOoSRtk7hoLB3RWhxUrjJYM700itC6rzQDzIcC0UbhIsXKM+uz foaBuD1vwpBU9LQnQrhvpLWIv3slOgRTLPsgNl8BIJrkh4TwQVJLY00TmFACgaqacIYg lxK8VyaST1nIoAjhgaIh0zsA1ZvCzGmFj95X4p0m8XVMMz/4Na/LbS/2PAN/Cs8NwFfH agVqVeCaFlbFprkqR8nr8YtfFkvCxnAqySnvdGp1eO6bICY1sCwN/gsgOTztCDYOIkdm E1WWVrpaqbzHFSJNF+Mi/ICVva+o/8emjerQE0VGionUWefzOMpF/bzg4czePQqUgd45 HD6Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=bKGOFOrZ7BMza00V4VWOGumsnPerA6syPDRBOc1jKv8=; b=RH30g+GgNxrj41YjBk8tU70n4dQcLY01PM0O1I6bM7C07QFZH+EhHjDEfdTexmFD07 X3o41o71bKbLJZhsa2VblNOtxCx7nYOnLy+316FWq82WYzgYAh0Su7pn2UujrH7I27SP cnlDe7tCKakt+vA3BEfpAjFnfNcoQIgn3JFc4f9PQ+orWkYxaS8WIhmvdprAUoBzPWrk Or8j4awuN8jTSUBg+ztAtqWLTxDQ0sQ3Ifu2xPKu8g9/AIR7V1BzPKijRpkRWQwiwZ7f CfgDy7zwjpqLAkMMzj4l7Ehs/0g1vKWovk0GsgXBzCwuQOvLolyXt6eXS4rWGmbR3uCZ t4Ag== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=sNevtD7d; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id t186si2035281pfd.68.2018.12.14.04.20.20; Fri, 14 Dec 2018 04:20:35 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=sNevtD7d; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732792AbeLNMTb (ORCPT + 99 others); Fri, 14 Dec 2018 07:19:31 -0500 Received: from mail.kernel.org ([198.145.29.99]:35870 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732633AbeLNMPt (ORCPT ); Fri, 14 Dec 2018 07:15:49 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C24D721486; Fri, 14 Dec 2018 12:15:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1544789748; bh=tdAYjcwV+RRZH+GLbGf72zdMqd6KGumyuZoZEKo/Yu0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sNevtD7dYEC660jdIoVi9V3W1vLJl46S1S8NIIESbvnIInHKYoB2/uKYayTiZOrFI ZufFDQC1G1lo2Up4PEj6lXAPvq51i+iz3gx1DldB1cy2o5Y/DLCy3TFBQI15caYz6a 90pMpa8WUKl87w//zK0e0epw89LDPTDdCNJCJJ+0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, NeilBrown , David Howells , Sasha Levin Subject: [PATCH 4.4 32/88] fscache: fix race between enablement and dropping of object Date: Fri, 14 Dec 2018 13:00:06 +0100 Message-Id: <20181214115704.790693902@linuxfoundation.org> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20181214115702.151309521@linuxfoundation.org> References: <20181214115702.151309521@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit c5a94f434c82529afda290df3235e4d85873c5b4 ] It was observed that a process blocked indefintely in __fscache_read_or_alloc_page(), waiting for FSCACHE_COOKIE_LOOKING_UP to be cleared via fscache_wait_for_deferred_lookup(). At this time, ->backing_objects was empty, which would normaly prevent __fscache_read_or_alloc_page() from getting to the point of waiting. This implies that ->backing_objects was cleared *after* __fscache_read_or_alloc_page was was entered. When an object is "killed" and then "dropped", FSCACHE_COOKIE_LOOKING_UP is cleared in fscache_lookup_failure(), then KILL_OBJECT and DROP_OBJECT are "called" and only in DROP_OBJECT is ->backing_objects cleared. This leaves a window where something else can set FSCACHE_COOKIE_LOOKING_UP and __fscache_read_or_alloc_page() can start waiting, before ->backing_objects is cleared There is some uncertainty in this analysis, but it seems to be fit the observations. Adding the wake in this patch will be handled correctly by __fscache_read_or_alloc_page(), as it checks if ->backing_objects is empty again, after waiting. Customer which reported the hang, also report that the hang cannot be reproduced with this fix. The backtrace for the blocked process looked like: PID: 29360 TASK: ffff881ff2ac0f80 CPU: 3 COMMAND: "zsh" #0 [ffff881ff43efbf8] schedule at ffffffff815e56f1 #1 [ffff881ff43efc58] bit_wait at ffffffff815e64ed #2 [ffff881ff43efc68] __wait_on_bit at ffffffff815e61b8 #3 [ffff881ff43efca0] out_of_line_wait_on_bit at ffffffff815e625e #4 [ffff881ff43efd08] fscache_wait_for_deferred_lookup at ffffffffa04f2e8f [fscache] #5 [ffff881ff43efd18] __fscache_read_or_alloc_page at ffffffffa04f2ffe [fscache] #6 [ffff881ff43efd58] __nfs_readpage_from_fscache at ffffffffa0679668 [nfs] #7 [ffff881ff43efd78] nfs_readpage at ffffffffa067092b [nfs] #8 [ffff881ff43efda0] generic_file_read_iter at ffffffff81187a73 #9 [ffff881ff43efe50] nfs_file_read at ffffffffa066544b [nfs] #10 [ffff881ff43efe70] __vfs_read at ffffffff811fc756 #11 [ffff881ff43efee8] vfs_read at ffffffff811fccfa #12 [ffff881ff43eff18] sys_read at ffffffff811fda62 #13 [ffff881ff43eff50] entry_SYSCALL_64_fastpath at ffffffff815e986e Signed-off-by: NeilBrown Signed-off-by: David Howells Signed-off-by: Sasha Levin --- fs/fscache/object.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/fscache/object.c b/fs/fscache/object.c index 7a182c87f378..ab1d7f35f6c2 100644 --- a/fs/fscache/object.c +++ b/fs/fscache/object.c @@ -715,6 +715,9 @@ static const struct fscache_state *fscache_drop_object(struct fscache_object *ob if (awaken) wake_up_bit(&cookie->flags, FSCACHE_COOKIE_INVALIDATING); + if (test_and_clear_bit(FSCACHE_COOKIE_LOOKING_UP, &cookie->flags)) + wake_up_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP); + /* Prevent a race with our last child, which has to signal EV_CLEARED * before dropping our spinlock. -- 2.19.1