)]}'
{
  "commit": "a621088213d3272950a85875afc25cc87b01b560",
  "tree": "7a20e7c1fdebb892e6184affec4fbc9380494692",
  "parents": [
    "6e8a1b8955ad234e6e52d8f3725ce03cbc7940ab"
  ],
  "author": {
    "name": "Hugh Dickins",
    "email": "hughd@google.com",
    "time": "Wed May 11 15:13:36 2011 -0700"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@suse.de",
    "time": "Sat May 21 15:13:23 2011 -0700"
  },
  "message": "tmpfs: fix race between umount and writepage\n\ncommit b1dea800ac39599301d4bb8dcf2b1d29c2558211 upstream.\n\nKonstanin Khlebnikov reports that a dangerous race between umount and\nshmem_writepage can be reproduced by this script:\n\n  for i in {1..300} ; do\n\tmkdir $i\n\twhile true ; do\n\t\tmount -t tmpfs none $i\n\t\tdd if\u003d/dev/zero of\u003d$i/test bs\u003d1M count\u003d$(($RANDOM % 100))\n\t\tumount $i\n\tdone \u0026\n  done\n\non a 6xCPU node with 8Gb RAM: kernel very unstable after this accident. \u003d)\n\nKernel log:\n\n  VFS: Busy inodes after unmount of tmpfs.\n                 Self-destruct in 5 seconds.  Have a nice day...\n\n  WARNING: at lib/list_debug.c:53 __list_del_entry+0x8d/0x98()\n  list_del corruption. prev-\u003enext should be ffff880222fdaac8, but was (null)\n  Pid: 11222, comm: mount.tmpfs Not tainted 2.6.39-rc2+ #4\n  Call Trace:\n   warn_slowpath_common+0x80/0x98\n   warn_slowpath_fmt+0x41/0x43\n   __list_del_entry+0x8d/0x98\n   evict+0x50/0x113\n   iput+0x138/0x141\n  ...\n  BUG: unable to handle kernel paging request at ffffffffffffffff\n  IP: shmem_free_blocks+0x18/0x4c\n  Pid: 10422, comm: dd Tainted: G        W   2.6.39-rc2+ #4\n  Call Trace:\n   shmem_recalc_inode+0x61/0x66\n   shmem_writepage+0xba/0x1dc\n   pageout+0x13c/0x24c\n   shrink_page_list+0x28e/0x4be\n   shrink_inactive_list+0x21f/0x382\n  ...\n\nshmem_writepage() calls igrab() on the inode for the page which came from\npage reclaim, to add it later into shmem_swaplist for swapoff operation.\n\nThis igrab() can race with super-block deactivating process:\n\n  shrink_inactive_list()          deactivate_super()\n  pageout()                       tmpfs_fs_type-\u003ekill_sb()\n  shmem_writepage()               kill_litter_super()\n                                  generic_shutdown_super()\n                                   evict_inodes()\n   igrab()\n                                    atomic_read(\u0026inode-\u003ei_count)\n                                     skip-inode\n   iput()\n                                   if (!list_empty(\u0026sb-\u003es_inodes))\n                                          printk(\"VFS: Busy inodes after...\n\nThis igrap-iput pair was added in commit 1b1b32f2c6f6 \"tmpfs: fix\nshmem_swaplist races\" based on incorrect assumptions: igrab() protects the\ninode from concurrent eviction by deletion, but it does nothing to protect\nit from concurrent unmounting, which goes ahead despite the raised\ni_count.\n\nSo this use of igrab() was wrong all along, but the race made much worse\nin 2.6.37 when commit 63997e98a3be \"split invalidate_inodes()\" replaced\ntwo attempts at invalidate_inodes() by a single evict_inodes().\n\nKonstantin posted a plausible patch, raising sb-\u003es_active too: I\u0027m unsure\nwhether it was correct or not; but burnt once by igrab(), I am sure that\nwe don\u0027t want to rely more deeply upon externals here.\n\nFix it by adding the inode to shmem_swaplist earlier, while the page lock\non page in page cache still secures the inode against eviction, without\nartifically raising i_count.  It was originally added later because\nshmem_unuse_inode() is liable to remove an inode from the list while it\u0027s\nunswapped; but we can guard against that by taking spinlock before\ndropping mutex.\n\nReported-by: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nTested-by: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8ac1684d790863ff392e86e73b28f14d0545610d",
      "old_mode": 33188,
      "old_path": "mm/shmem.c",
      "new_id": "bd376ba6fd3cdb8222d4f36dd508ae426c707170",
      "new_mode": 33188,
      "new_path": "mm/shmem.c"
    }
  ]
}