LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Ross Lagerwall <ross.lagerwall@citrix.com>,
	Andreas Gruenbacher <agruenba@redhat.com>,
	Sasha Levin <sashal@kernel.org>,
	cluster-devel@redhat.com
Subject: [PATCH AUTOSEL 5.0 001/317] gfs2: Fix lru_count going negative
Date: Wed, 22 May 2019 15:18:22 -0400	[thread overview]
Message-ID: <20190522192338.23715-1-sashal@kernel.org> (raw)

From: Ross Lagerwall <ross.lagerwall@citrix.com>

[ Upstream commit 7881ef3f33bb80f459ea6020d1e021fc524a6348 ]

Under certain conditions, lru_count may drop below zero resulting in
a large amount of log spam like this:

vmscan: shrink_slab: gfs2_dump_glock+0x3b0/0x630 [gfs2] \
    negative objects to delete nr=-1

This happens as follows:
1) A glock is moved from lru_list to the dispose list and lru_count is
   decremented.
2) The dispose function calls cond_resched() and drops the lru lock.
3) Another thread takes the lru lock and tries to add the same glock to
   lru_list, checking if the glock is on an lru list.
4) It is on a list (actually the dispose list) and so it avoids
   incrementing lru_count.
5) The glock is moved to lru_list.
5) The original thread doesn't dispose it because it has been re-added
   to the lru list but the lru_count has still decreased by one.

Fix by checking if the LRU flag is set on the glock rather than checking
if the glock is on some list and rearrange the code so that the LRU flag
is added/removed precisely when the glock is added/removed from lru_list.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/glock.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 4b038f25f2564..2d25d89e77f9b 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -183,15 +183,19 @@ static int demote_ok(const struct gfs2_glock *gl)
 
 void gfs2_glock_add_to_lru(struct gfs2_glock *gl)
 {
+	if (!(gl->gl_ops->go_flags & GLOF_LRU))
+		return;
+
 	spin_lock(&lru_lock);
 
-	if (!list_empty(&gl->gl_lru))
-		list_del_init(&gl->gl_lru);
-	else
+	list_del(&gl->gl_lru);
+	list_add_tail(&gl->gl_lru, &lru_list);
+
+	if (!test_bit(GLF_LRU, &gl->gl_flags)) {
+		set_bit(GLF_LRU, &gl->gl_flags);
 		atomic_inc(&lru_count);
+	}
 
-	list_add_tail(&gl->gl_lru, &lru_list);
-	set_bit(GLF_LRU, &gl->gl_flags);
 	spin_unlock(&lru_lock);
 }
 
@@ -201,7 +205,7 @@ static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
 		return;
 
 	spin_lock(&lru_lock);
-	if (!list_empty(&gl->gl_lru)) {
+	if (test_bit(GLF_LRU, &gl->gl_flags)) {
 		list_del_init(&gl->gl_lru);
 		atomic_dec(&lru_count);
 		clear_bit(GLF_LRU, &gl->gl_flags);
@@ -1159,8 +1163,7 @@ void gfs2_glock_dq(struct gfs2_holder *gh)
 		    !test_bit(GLF_DEMOTE, &gl->gl_flags))
 			fast_path = 1;
 	}
-	if (!test_bit(GLF_LFLUSH, &gl->gl_flags) && demote_ok(gl) &&
-	    (glops->go_flags & GLOF_LRU))
+	if (!test_bit(GLF_LFLUSH, &gl->gl_flags) && demote_ok(gl))
 		gfs2_glock_add_to_lru(gl);
 
 	trace_gfs2_glock_queue(gh, 0);
@@ -1456,6 +1459,7 @@ __acquires(&lru_lock)
 		if (!spin_trylock(&gl->gl_lockref.lock)) {
 add_back_to_lru:
 			list_add(&gl->gl_lru, &lru_list);
+			set_bit(GLF_LRU, &gl->gl_flags);
 			atomic_inc(&lru_count);
 			continue;
 		}
@@ -1463,7 +1467,6 @@ __acquires(&lru_lock)
 			spin_unlock(&gl->gl_lockref.lock);
 			goto add_back_to_lru;
 		}
-		clear_bit(GLF_LRU, &gl->gl_flags);
 		gl->gl_lockref.count++;
 		if (demote_ok(gl))
 			handle_callback(gl, LM_ST_UNLOCKED, 0, false);
@@ -1498,6 +1501,7 @@ static long gfs2_scan_glock_lru(int nr)
 		if (!test_bit(GLF_LOCK, &gl->gl_flags)) {
 			list_move(&gl->gl_lru, &dispose);
 			atomic_dec(&lru_count);
+			clear_bit(GLF_LRU, &gl->gl_flags);
 			freed++;
 			continue;
 		}
-- 
2.20.1


             reply	other threads:[~2019-05-22 19:23 UTC|newest]

Thread overview: 107+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-22 19:18 Sasha Levin [this message]
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 002/317] cxgb4: Fix error path in cxgb4_init_module Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 003/317] afs: Fix getting the afs.fid xattr Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 004/317] NFS: make nfs_match_client killable Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 005/317] gfs2: fix race between gfs2_freeze_func and unmount Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 006/317] IB/hfi1: Fix WQ_MEM_RECLAIM warning Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 007/317] gfs2: Fix occasional glock use-after-free Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 008/317] mmc: core: Verify SD bus width Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 009/317] batman-adv: mcast: fix multicast tt/tvlv worker locking Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 010/317] tools/bpf: fix perf build error with uClibc (seen on ARC) Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 011/317] selftests/bpf: set RLIMIT_MEMLOCK properly for test_libbpf_open.c Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 012/317] bpftool: exclude bash-completion/bpftool from .gitignore pattern Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 013/317] ice: Separate if conditions for ice_set_features() Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 014/317] blk-mq: split blk_mq_alloc_and_init_hctx into two parts Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 015/317] blk-mq: grab .q_usage_counter when queuing request from plug code path Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 016/317] dmaengine: tegra210-dma: free dma controller in remove() Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 017/317] net: ena: gcc 8: fix compilation warning Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 018/317] net: ena: fix: set freed objects to NULL to avoid failing future allocations Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 019/317] hv_netvsc: fix race that may miss tx queue wakeup Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 020/317] orangefs: truncate before updating size Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 021/317] Bluetooth: Ignore CC events not matching the last HCI command Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 022/317] pinctrl: zte: fix leaked of_node references Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 023/317] ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 024/317] usb: dwc2: gadget: Increase descriptors count for ISOC's Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 025/317] usb: dwc3: move synchronize_irq() out of the spinlock protected block Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 026/317] usb: gadget: f_fs: don't free buffer prematurely Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 027/317] ASoC: hdmi-codec: unlock the device on startup errors Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 028/317] leds: avoid races with workqueue Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 029/317] powerpc/perf: Return accordingly on invalid chip-id in Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 030/317] powerpc/boot: Fix missing check of lseek() return value Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 031/317] powerpc/perf: Fix loop exit condition in nest_imc_event_init Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 032/317] spi: atmel-quadspi: fix crash while suspending Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 033/317] ASoC: imx: fix fiq dependencies Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 034/317] spi: pxa2xx: fix SCR (divisor) calculation Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 035/317] brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler() Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 036/317] ACPI / property: fix handling of data_nodes in acpi_get_next_subnode() Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 037/317] drm/nouveau/bar/nv50: ensure BAR is mapped Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 038/317] media: stm32-dcmi: return appropriate error codes during probe Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 039/317] ARM: vdso: Remove dependency with the arch_timer driver internals Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 040/317] arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 041/317] x86/ftrace: Set trampoline pages as executable Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 042/317] powerpc/watchdog: Use hrtimers for per-CPU heartbeat Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 043/317] sched/cpufreq: Fix kobject memleak Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 044/317] scsi: qla2xxx: Fix a qla24xx_enable_msix() error path Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 045/317] scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending() Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 046/317] scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in tcm_qla2xxx_close_session() Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 047/317] scsi: qla2xxx: Fix hardirq-unsafe locking Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 048/317] x86/modules: Avoid breaking W^X while loading modules Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 049/317] Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 050/317] btrfs: fix panic during relocation after ENOSPC before writeback happens Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 051/317] btrfs: Don't panic when we can't find a root key Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 052/317] iwlwifi: pcie: don't crash on invalid RX interrupt Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 053/317] rtc: 88pm860x: prevent use-after-free on device remove Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 054/317] rtc: stm32: manage the get_irq probe defer case Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 055/317] scsi: qedi: Abort ep termination if offload not scheduled Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 056/317] s390/kexec_file: Fix detection of text segment in ELF loader Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 057/317] ALSA: hda: fix unregister device twice on ASoC driver Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 058/317] sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 059/317] net: ethernet: ti: cpsw: fix allmulti cfg in dual_mac mode Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 060/317] w1: fix the resume command API Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 061/317] net: hns3: fix for TX clean num when cleaning TX BD Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 062/317] net: phy: improve genphy_soft_reset Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 063/317] s390: qeth: address type mismatch warning Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 064/317] net: hns3: use atomic_t replace u32 for arq's count Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 065/317] dmaengine: pl330: _stop: clear interrupt status Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 066/317] mac80211/cfg80211: update bss channel on channel switch Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 067/317] USB: serial: fix initial-termios handling Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 068/317] libbpf: fix samples/bpf build failure due to undefined UINT32_MAX Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 069/317] slimbus: fix a potential NULL pointer dereference in of_qcom_slim_ngd_register Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 070/317] driver core: platform: Fix the usage of platform device name(pdev->name) Sasha Levin
2019-05-22 20:04   ` Greg Kroah-Hartman
2019-05-29 18:57     ` Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 071/317] driver core: Postpone DMA tear-down until after devres release for probe failure Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 072/317] ASoC: fsl_sai: Update is_slave_mode with correct value Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 073/317] Fix nfs4.2 return -EINVAL when do dedupe operation Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 074/317] mwifiex: prevent an array overflow Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 075/317] rsi: Fix NULL pointer dereference in kmalloc Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 076/317] net: cw1200: fix a NULL pointer dereference Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 077/317] at76c50x-usb: Don't register led_trigger if usb_register_driver failed Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 078/317] nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 079/317] nvme-rdma: fix a NULL deref when an admin connect times out Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 080/317] nvme-tcp: " Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 081/317] ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 082/317] crypto: sun4i-ss - Fix invalid calculation of hash end Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 083/317] bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 084/317] bcache: return error immediately in bch_journal_replay() Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 085/317] bcache: fix failure in journal relplay Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 086/317] bcache: add failure check to run_cache_set() for journal replay Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 087/317] bcache: avoid clang -Wunintialized warning Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 088/317] RDMA/cma: Consider scope_id while binding to ipv6 ll address Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 089/317] vfio-ccw: Do not call flush_workqueue while holding the spinlock Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 090/317] vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 091/317] x86/build: Move _etext to actual end of .text Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 092/317] smpboot: Place the __percpu annotation correctly Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 093/317] x86/uaccess: Dont leak the AC flag into __put_user() argument evaluation Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 094/317] x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault() Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 095/317] mlxsw: spectrum_router: Prevent ipv6 gateway with v4 route via replace and append Sasha Levin
2019-05-22 19:27   ` David Ahern
2019-05-29 19:00     ` Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 096/317] mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 097/317] Bluetooth: hci_qca: Give enough time to ROME controller to bootup Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 098/317] Bluetooth: btbcm: Add default address for BCM43341B Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 099/317] HID: logitech-hidpp: use RAP instead of FAP to get the protocol version Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 100/317] pinctrl: pistachio: fix leaked of_node references Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 101/317] pinctrl: st: " Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 102/317] pinctrl: samsung: " Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 103/317] clk: rockchip: undo several noc and special clocks as critical on rk3288 Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190522192338.23715-1-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=agruenba@redhat.com \
    --cc=cluster-devel@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ross.lagerwall@citrix.com \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH AUTOSEL 5.0 001/317] gfs2: Fix lru_count going negative' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).