public inbox for [email protected]
 help / color / mirror / Atom feed
From: Matthew Wilcox <[email protected]>
To: [email protected]
Cc: Johannes Weiner <[email protected]>, Jens Axboe <[email protected]>
Subject: Loophole in async page I/O
Date: Mon, 12 Oct 2020 22:13:55 +0100	[thread overview]
Message-ID: <[email protected]> (raw)

This one's pretty unlikely, but there's a case in buffered reads where
an IOCB_WAITQ read can end up sleeping.

generic_file_buffered_read():
                page = find_get_page(mapping, index);
...
                if (!PageUptodate(page)) {
...
                        if (iocb->ki_flags & IOCB_WAITQ) {
...
                                error = wait_on_page_locked_async(page,
                                                                iocb->ki_waitq);
wait_on_page_locked_async():
        if (!PageLocked(page))
                return 0;
(back to generic_file_buffered_read):
                        if (!mapping->a_ops->is_partially_uptodate(page,
                                                        offset, iter->count))
                                goto page_not_up_to_date_locked;

page_not_up_to_date_locked:
                if (iocb->ki_flags & (IOCB_NOIO | IOCB_NOWAIT)) {
                        unlock_page(page);
                        put_page(page);
                        goto would_block;
                }
...
                error = mapping->a_ops->readpage(filp, page);
(will unlock page on I/O completion)
                if (!PageUptodate(page)) {
                        error = lock_page_killable(page);

So if we have IOCB_WAITQ set but IOCB_NOWAIT clear, we'll call ->readpage()
and wait for the I/O to complete.  I can't quite figure out if this is
intentional -- I think not; if I understand the semantics right, we
should be returning -EIOCBQUEUED and punting to an I/O thread to
kick off the I/O and wait.

I think the right fix is to return -EIOCBQUEUED from
wait_on_page_locked_async() if the page isn't locked.  ie this:

@@ -1258,7 +1258,7 @@ static int wait_on_page_locked_async(struct page *page,
                                     struct wait_page_queue *wait)
 {
        if (!PageLocked(page))
-               return 0;
+               return -EIOCBQUEUED;
        return __wait_on_page_locked_async(compound_head(page), wait, false);
 }
 
But as I said, I'm not sure what the semantics are supposed to be.

             reply	other threads:[~2020-10-12 21:13 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-12 21:13 Matthew Wilcox [this message]
2020-10-12 22:08 ` Loophole in async page I/O Jens Axboe
2020-10-12 22:22   ` Jens Axboe
2020-10-12 22:42     ` Jens Axboe
2020-10-14 20:31       ` Hao_Xu
2020-10-14 20:57         ` Jens Axboe
2020-10-15 11:27           ` Hao_Xu
2020-10-15 12:17             ` Hao_Xu
2020-10-13  5:31   ` Hao_Xu
2020-10-13 17:50     ` Jens Axboe
2020-10-13 19:50       ` Hao_Xu
2020-10-13  5:13 ` Hao_Xu
2020-10-13 12:01   ` Matthew Wilcox
2020-10-13 19:57     ` Hao_Xu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox