mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-11-01 17:08:10 +00:00
b6fac63cc1
clear_inode() will switch inode state from I_FREEING to I_CLEAR, and do so
_outside_ of inode_lock. So any I_FREEING testing is incomplete without a
coupled testing of I_CLEAR.
So add I_CLEAR tests to drop_pagecache_sb(), generic_sync_sb_inodes() and
add_dquot_ref().
Masayoshi MIZUMA discovered the bug in drop_pagecache_sb() and Jan Kara
reminds fixing the other two cases.
Masayoshi MIZUMA has a nice panic flow:
=====================================================================
[process A] | [process B]
| |
| prune_icache() | drop_pagecache()
| spin_lock(&inode_lock) | drop_pagecache_sb()
| inode->i_state |= I_FREEING; | |
| spin_unlock(&inode_lock) | V
| | | spin_lock(&inode_lock)
| V | |
| dispose_list() | |
| list_del() | |
| clear_inode() | |
| inode->i_state = I_CLEAR | |
| | | V
| | | if (inode->i_state & (I_FREEING|I_WILL_FREE))
| | | continue; <==== NOT MATCH
| | |
| | | (DANGER from here on! Accessing disposing inode!)
| | |
| | | __iget()
| | | list_move() <===== PANIC on poisoned list !!
V V |
(time)
=====================================================================
Reported-by: Masayoshi MIZUMA <m.mizuma@jp.fujitsu.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
76 lines
1.7 KiB
C
76 lines
1.7 KiB
C
/*
|
|
* Implement the manual drop-all-pagecache function
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/writeback.h>
|
|
#include <linux/sysctl.h>
|
|
#include <linux/gfp.h>
|
|
|
|
/* A global variable is a bit ugly, but it keeps the code simple */
|
|
int sysctl_drop_caches;
|
|
|
|
static void drop_pagecache_sb(struct super_block *sb)
|
|
{
|
|
struct inode *inode, *toput_inode = NULL;
|
|
|
|
spin_lock(&inode_lock);
|
|
list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
|
|
if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE|I_NEW))
|
|
continue;
|
|
if (inode->i_mapping->nrpages == 0)
|
|
continue;
|
|
__iget(inode);
|
|
spin_unlock(&inode_lock);
|
|
__invalidate_mapping_pages(inode->i_mapping, 0, -1, true);
|
|
iput(toput_inode);
|
|
toput_inode = inode;
|
|
spin_lock(&inode_lock);
|
|
}
|
|
spin_unlock(&inode_lock);
|
|
iput(toput_inode);
|
|
}
|
|
|
|
static void drop_pagecache(void)
|
|
{
|
|
struct super_block *sb;
|
|
|
|
spin_lock(&sb_lock);
|
|
restart:
|
|
list_for_each_entry(sb, &super_blocks, s_list) {
|
|
sb->s_count++;
|
|
spin_unlock(&sb_lock);
|
|
down_read(&sb->s_umount);
|
|
if (sb->s_root)
|
|
drop_pagecache_sb(sb);
|
|
up_read(&sb->s_umount);
|
|
spin_lock(&sb_lock);
|
|
if (__put_super_and_need_restart(sb))
|
|
goto restart;
|
|
}
|
|
spin_unlock(&sb_lock);
|
|
}
|
|
|
|
static void drop_slab(void)
|
|
{
|
|
int nr_objects;
|
|
|
|
do {
|
|
nr_objects = shrink_slab(1000, GFP_KERNEL, 1000);
|
|
} while (nr_objects > 10);
|
|
}
|
|
|
|
int drop_caches_sysctl_handler(ctl_table *table, int write,
|
|
struct file *file, void __user *buffer, size_t *length, loff_t *ppos)
|
|
{
|
|
proc_dointvec_minmax(table, write, file, buffer, length, ppos);
|
|
if (write) {
|
|
if (sysctl_drop_caches & 1)
|
|
drop_pagecache();
|
|
if (sysctl_drop_caches & 2)
|
|
drop_slab();
|
|
}
|
|
return 0;
|
|
}
|