From: Hillf Danton <hdanton@sina.com>
To: David Howells <dhowells@redhat.com>
Cc: Jens Axboe <axboe@kernel.dk>, Christoph Hellwig <hch@lst.de>,
David Hildenbrand <david@redhat.com>,
John Hubbard <jhubbard@nvidia.com>,
linux-mm@kvack.org, linux-block@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: Need help tracking down a bug in the bio-FOLL_PIN patches
Date: Tue, 7 Feb 2023 17:47:31 +0800 [thread overview]
Message-ID: <20230207094731.1390-1-hdanton@sina.com> (raw)
In-Reply-To: <2811508.1675724572@warthog.procyon.org.uk>
On Mon, 06 Feb 2023 23:02:52 +0000 David Howells <dhowells@redhat.com>
> Hi Jens, Christoph,
>
> I need some help tracking down a bug in the patches that make the bio usin=
> g
> page pinning or no pinning using iov_iter_extract_pages(). The bug causes
> seemingly random memory corruption once the "block: Convert
> bio_iov_iter_get_pages to use iov_iter_extract_pages" patch is applied.
>
> The bug was detected by a syzbot special:
>
> https://lore.kernel.org/r/000000000000b0b3c005f3a09383@google.com/
@@ -1342,7 +1342,8 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
return 0;
}
- bio_set_flag(bio, BIO_PAGE_REFFED);
+ if (iov_iter_extract_will_pin(iter))
+ bio_set_flag(bio, BIO_PAGE_PINNED);
do {
ret = __bio_iov_iter_get_pages(bio, iter);
} while (!ret && iov_iter_count(iter) && !bio_full(bio, 0));
I suspect it is due to the above change, given the following call trace.
pipe_buf_release include/linux/pipe_fs_i.h:183 [inline]
iov_iter_revert.part.0+0x402/0x730 lib/iov_iter.c:935
iov_iter_revert+0x4c/0x60 lib/iov_iter.c:919
__iomap_dio_rw+0x16cb/0x1d80 fs/iomap/direct-io.c:610
iomap_dio_rw+0x40/0xa0 fs/iomap/direct-io.c:682
ext4_dio_read_iter fs/ext4/file.c:94 [inline]
ext4_file_read_iter+0x4be/0x690 fs/ext4/file.c:145
call_read_iter include/linux/fs.h:1845 [inline]
generic_file_splice_read+0x182/0x4b0 fs/splice.c:309
do_splice_to+0x1b9/0x240 fs/splice.c:793
splice_direct_to_actor+0x2ab/0x8a0 fs/splice.c:865
do_splice_direct+0x1ab/0x280 fs/splice.c:974
do_sendfile+0xb19/0x12c0 fs/read_write.c:1255
__do_sys_sendfile64 fs/read_write.c:1323 [inline]
__se_sys_sendfile64 fs/read_write.c:1309 [inline]
__x64_sys_sendfile64+0x1d0/0x210 fs/read_write.c:1309
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
next prev parent reply other threads:[~2023-02-07 9:47 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-06 23:02 David Howells
2023-02-06 23:20 ` David Howells
2023-02-07 9:47 ` Hillf Danton [this message]
2023-02-07 10:44 ` David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230207094731.1390-1-hdanton@sina.com \
--to=hdanton@sina.com \
--cc=axboe@kernel.dk \
--cc=david@redhat.com \
--cc=dhowells@redhat.com \
--cc=hch@lst.de \
--cc=jhubbard@nvidia.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox