From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 815E6C433F5 for ; Fri, 20 May 2022 08:17:53 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9DB746B0071; Fri, 20 May 2022 04:17:52 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9630C6B0072; Fri, 20 May 2022 04:17:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 82B026B0073; Fri, 20 May 2022 04:17:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 6D17B6B0071 for ; Fri, 20 May 2022 04:17:52 -0400 (EDT) Received: from smtpin31.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 3753C217E8 for ; Fri, 20 May 2022 08:17:52 +0000 (UTC) X-FDA: 79485417984.31.31C828A Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by imf10.hostedemail.com (Postfix) with ESMTP id 1B311C0013 for ; Fri, 20 May 2022 08:17:18 +0000 (UTC) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.56]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4L4KLZ5qj0zfbLy; Fri, 20 May 2022 16:16:22 +0800 (CST) Received: from [10.174.177.76] (10.174.177.76) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Fri, 20 May 2022 16:17:46 +0800 Subject: Re: [PATCH v4 4/5] mm/shmem: fix infinite loop when swap in shmem error at swapoff time To: =?UTF-8?B?SE9SSUdVQ0hJIE5BT1lBKOWggOWPoyDnm7TkuZ8p?= CC: "akpm@linux-foundation.org" , "hughd@google.com" , "willy@infradead.org" , "vbabka@suse.cz" , "dhowells@redhat.com" , "neilb@suse.de" , "apopple@nvidia.com" , "david@redhat.com" , "surenb@google.com" , "peterx@redhat.com" , "rcampbell@nvidia.com" , "linux-mm@kvack.org" , "linux-kernel@vger.kernel.org" References: <20220519125030.21486-1-linmiaohe@huawei.com> <20220519125030.21486-5-linmiaohe@huawei.com> <20220520063433.GA584983@hori.linux.bs1.fc.nec.co.jp> From: Miaohe Lin Message-ID: <970aee34-c377-2b8c-c6bb-45e2a96e84b9@huawei.com> Date: Fri, 20 May 2022 16:17:45 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.6.0 MIME-Version: 1.0 In-Reply-To: <20220520063433.GA584983@hori.linux.bs1.fc.nec.co.jp> Content-Type: text/plain; charset="utf-8" Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [10.174.177.76] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected X-Rspam-User: X-Rspamd-Server: rspam11 X-Rspamd-Queue-Id: 1B311C0013 X-Stat-Signature: t8a7k8h7517uihz4g4tkwgnzp45155f5 Authentication-Results: imf10.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf10.hostedemail.com: domain of linmiaohe@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=linmiaohe@huawei.com X-HE-Tag: 1653034638-579433 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 2022/5/20 14:34, HORIGUCHI NAOYA(堀口 直也) wrote: > On Thu, May 19, 2022 at 08:50:29PM +0800, Miaohe Lin wrote: >> When swap in shmem error at swapoff time, there would be a infinite loop >> in the while loop in shmem_unuse_inode(). It's because swapin error is >> deliberately ignored now and thus info->swapped will never reach 0. So >> we can't escape the loop in shmem_unuse(). >> >> In order to fix the issue, swapin_error entry is stored in the mapping >> when swapin error occurs. So the swapcache page can be freed and the >> user won't end up with a permanently mounted swap because a sector is >> bad. If the page is accessed later, the user process will be killed >> so that corrupted data is never consumed. On the other hand, if the >> page is never accessed, the user won't even notice it. >> >> Reported-by: Naoya Horiguchi >> Signed-off-by: Miaohe Lin > > Hi Miaohe, > > Thank you for the update. I might miss something, but I still see the same > problem (I checked it on mm-everything-2022-05-19-00-03 + this patchset). I was testing this patch on my 5.10 kernel. I reproduced the problem in my env and fixed it. It seems there might be some critical difference though I checked that by reviewing the code... Sorry. :( > > This patch has the effect to change the return value of shmem_swapin_folio(), > -EIO (without this patch) to -EEXIST (with this patch). In fact, I didn't change the return value from -EIO to -EEXIST: @@ -1762,6 +1799,8 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index, failed: if (!shmem_confirm_swap(mapping, index, swap)) error = -EEXIST; + if (error == -EIO) + shmem_set_folio_swapin_error(inode, index, folio, swap) > But shmem_unuse_swap_entries() checks neither, so no change from caller's view point. > Maybe breaking in errors (rather than ENOMEM) in for loop in shmem_unuse_swap_entries() > solves the issue? I briefly checked with the below change, then swapoff can return > with failure. > > @@ -1222,7 +1222,7 @@ static int shmem_unuse_swap_entries(struct inode *inode, > folio_put(folio); > ret++; > } > - if (error == -ENOMEM) > + if (error < 0) > break; > error = 0; > } Yes, this is the simplest and straightforward way to fix the issue. But it has the side effect that user will end up with a permanently mounted swap just because a sector is bad. That might be somewhat unacceptable? > >> --- >> mm/shmem.c | 39 +++++++++++++++++++++++++++++++++++++++ >> 1 file changed, 39 insertions(+) >> >> diff --git a/mm/shmem.c b/mm/shmem.c >> index d3c7970e0179..d55dd972023a 100644 >> --- a/mm/shmem.c >> +++ b/mm/shmem.c >> @@ -1175,6 +1175,10 @@ static int shmem_find_swap_entries(struct address_space *mapping, >> continue; >> >> entry = radix_to_swp_entry(folio); >> + /* >> + * swapin error entries can be found in the mapping. But they're >> + * deliberately ignored here as we've done everything we can do. >> + */ >> if (swp_type(entry) != type) >> continue; >> >> @@ -1672,6 +1676,36 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp, >> return error; >> } >> >> +static void shmem_set_folio_swapin_error(struct inode *inode, pgoff_t index, >> + struct folio *folio, swp_entry_t swap) >> +{ >> + struct address_space *mapping = inode->i_mapping; >> + struct shmem_inode_info *info = SHMEM_I(inode); >> + swp_entry_t swapin_error; >> + void *old; >> + >> + swapin_error = make_swapin_error_entry(&folio->page); >> + old = xa_cmpxchg_irq(&mapping->i_pages, index, >> + swp_to_radix_entry(swap), >> + swp_to_radix_entry(swapin_error), 0); >> + if (old != swp_to_radix_entry(swap)) >> + return; >> + >> + folio_wait_writeback(folio); >> + delete_from_swap_cache(&folio->page); >> + spin_lock_irq(&info->lock); >> + /* >> + * Don't treat swapin error folio as alloced. Otherwise inode->i_blocks won't >> + * be 0 when inode is released and thus trigger WARN_ON(inode->i_blocks) in >> + * shmem_evict_inode. >> + */ >> + info->alloced--; >> + info->swapped--; >> + shmem_recalc_inode(inode); >> + spin_unlock_irq(&info->lock); >> + swap_free(swap); >> +} >> + >> /* >> * Swap in the page pointed to by *pagep. >> * Caller has to make sure that *pagep contains a valid swapped page. > > (off-topic a little) BTW, the comment on shmem_swapin_folio() still mentions > *pagep, but maybe it can be updated to *foliop. Will do it. > > Thanks, > Naoya Horiguchi Many thanks for comment and test ! :) > >> @@ -1695,6 +1729,9 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index, >> swap = radix_to_swp_entry(*foliop); >> *foliop = NULL; >> >> + if (is_swapin_error_entry(swap)) >> + return -EIO; >> + >> /* Look it up and read it in.. */ >> page = lookup_swap_cache(swap, NULL, 0); >> if (!page) { >> @@ -1762,6 +1799,8 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index, >> failed: >> if (!shmem_confirm_swap(mapping, index, swap)) >> error = -EEXIST; >> + if (error == -EIO) >> + shmem_set_folio_swapin_error(inode, index, folio, swap);