From owner-freebsd-bugs@FreeBSD.ORG Fri Oct 2 18:20:01 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A8BF11065692 for ; Fri, 2 Oct 2009 18:20:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 868D58FC1E for ; Fri, 2 Oct 2009 18:20:01 +0000 (UTC) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n92IK1sa081062 for ; Fri, 2 Oct 2009 18:20:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n92IK1n6081061; Fri, 2 Oct 2009 18:20:01 GMT (envelope-from gnats) Resent-Date: Fri, 2 Oct 2009 18:20:01 GMT Resent-Message-Id: <200910021820.n92IK1n6081061@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Gleb Kurtsou Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9582210656A9 for ; Fri, 2 Oct 2009 18:11:55 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 6AFDD8FC19 for ; Fri, 2 Oct 2009 18:11:55 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n92IBt7w073247 for ; Fri, 2 Oct 2009 18:11:55 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n92IBtib073246; Fri, 2 Oct 2009 18:11:55 GMT (envelope-from nobody) Message-Id: <200910021811.n92IBtib073246@www.freebsd.org> Date: Fri, 2 Oct 2009 18:11:55 GMT From: Gleb Kurtsou To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/139312: [PATCH] tmpfs mmap synchronization bug X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2009 18:20:01 -0000 >Number: 139312 >Category: kern >Synopsis: [PATCH] tmpfs mmap synchronization bug >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Oct 02 18:20:01 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Gleb Kurtsou >Release: 9-CURRENT >Organization: >Environment: FreeBSD tops 9.0-CURRENT FreeBSD 9.0-CURRENT #6 r197608+311ce2b: Tue Sep 29 09:02:48 EEST 2009 root@tops:/usr/obj/usr/freebsd-src/local/sys/TOPS amd64 >Description: Mmaped pages can get out of sync in tmpfs. The bug is 100% reproducible by: # fsx -S 125 -d /tmpfs/file It breaks at operation 42. Fix is inspired by zfs, it calls vm_page_cache_free(). Reading zfs sources, it looks like it doesn't check v_object->cache, but never the less bug never shows up on there. Probably it's because of zfs using VOP_BMAP to do page mapping. tmpfs uses default vop_getpages/vop_putpages which invokes vop_read/vop_write accordingly. Removing v_object->cache == NULL checks breaks things again. The same fix works fine in pefs (http://wiki.freebsd.org/SOC2009GlebKurtsov) >How-To-Repeat: # fsx -S 125 -d /tmpfs/file It breaks at operation 42. >Fix: Patch attached with submission follows: diff --git a/sys/fs/tmpfs/tmpfs_vnops.c b/sys/fs/tmpfs/tmpfs_vnops.c index db8ceea..59d94d7 100644 --- a/sys/fs/tmpfs/tmpfs_vnops.c +++ b/sys/fs/tmpfs/tmpfs_vnops.c @@ -444,7 +444,8 @@ tmpfs_mappedread(vm_object_t vobj, vm_object_t tobj, size_t len, struct uio *uio offset = addr & PAGE_MASK; tlen = MIN(PAGE_SIZE - offset, len); - if ((vobj == NULL) || (vobj->resident_page_count == 0)) + if ((vobj == NULL) || + (vobj->resident_page_count == 0 && vobj->cache == NULL)) goto nocache; VM_OBJECT_LOCK(vobj); @@ -555,7 +556,8 @@ tmpfs_mappedwrite(vm_object_t vobj, vm_object_t tobj, size_t len, struct uio *ui offset = addr & PAGE_MASK; tlen = MIN(PAGE_SIZE - offset, len); - if ((vobj == NULL) || (vobj->resident_page_count == 0)) { + if ((vobj == NULL) || + (vobj->resident_page_count == 0 && vobj->cache == NULL)) { vpg = NULL; goto nocache; } @@ -573,6 +575,8 @@ lookupvpg: VM_OBJECT_UNLOCK(vobj); error = uiomove_fromphys(&vpg, offset, tlen, uio); } else { + if (__predict_false(vobj->cache != NULL)) + vm_page_cache_free(vobj, idx, idx + 1); VM_OBJECT_UNLOCK(vobj); vpg = NULL; } >Release-Note: >Audit-Trail: >Unformatted: