Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From:   Qian Cai <cai@lca.pw>
Mime-Version: 1.0 (1.0)
Subject: Re: WARN_ON_ONCE(1) in iomap_dio_actor()
Date:   Thu, 13 Aug 2020 03:52:13 -0400
Message-Id: <B409CB60-3A36-480D-964B-90043490B7B9@lca.pw>
References: <20200813054418.GB3339@dread.disaster.area>
Cc:     Christoph Hellwig <hch@infradead.org>,
        Matthew Wilcox <willy@infradead.org>, darrick.wong@oracle.com,
        linux-xfs@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        linux-kernel@vger.kernel.org, khlebnikov@yandex-team.ru
In-Reply-To: <20200813054418.GB3339@dread.disaster.area>
To:     Dave Chinner <david@fromorbit.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Aug 13, 2020, at 1:44 AM, Dave Chinner <david@fromorbit.com> wrote:
>=20
> Ok:
>=20
> file.fd_write =3D safe_open("./testfile", O_RDWR|O_CREAT);
> ....
> file.fd_read =3D safe_open("./testfile", O_RDWR|O_CREAT|O_DIRECT);
> ....
> file.ptr =3D safe_mmap(NULL, fsize, PROT_READ|PROT_WRITE, MAP_SHARED,
>            file.fd_write, 0);
>=20
> So this is all IO to the same inode....
>=20
> and you loop
>=20
> while !done {
>=20
>    do {
>        rc =3D pread(file.fd_read, file.ptr + read, fsize - read,
>            read);
>        if (rc > 0)
>            read +=3D rc;
>    } while (rc > 0);
>=20
>    rc =3D safe_fallocate(file.fd_write,
>            FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
>            0, fsize);
> }
>=20
> On two threads at once?
>=20
> So, essentially, you do a DIO read into a mmap()d range from the
> same file, with DIO read ascending and the mmap() range descending,
> then once that is done you hole punch the file and do it again?
>=20
> IOWs, this is a racing page_mkwrite()/DIO read workload, and the
> moment the two threads hit the same block of the file with a
> DIO read and a page_mkwrite at the same time, it throws a warning.
>=20
> Well, that's completely expected behaviour. DIO is not serialised
> against mmap() access at all, and so if the page_mkwrite occurs
> between the writeback and the iomap_apply() call in the dio path,
> then it will see the delalloc block taht the page-mkwrite allocated.
>=20
> No sane application would ever do this, it's behaviour as expected,
> so I don't think there's anything to care about here.

It looks me the kernel warning is trivial to trigger by an non-root user. Sh=
ouldn=E2=80=99t we worry a bit because this could be a DoS for systems which=
 set panic_on_warn?=