From nobody@FreeBSD.org  Fri Oct  2 18:11:55 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 9582210656A9
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  2 Oct 2009 18:11:55 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 6AFDD8FC19
	for <freebsd-gnats-submit@FreeBSD.org>; Fri,  2 Oct 2009 18:11:55 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n92IBt7w073247
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 2 Oct 2009 18:11:55 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n92IBtib073246;
	Fri, 2 Oct 2009 18:11:55 GMT
	(envelope-from nobody)
Message-Id: <200910021811.n92IBtib073246@www.freebsd.org>
Date: Fri, 2 Oct 2009 18:11:55 GMT
From: Gleb Kurtsou <gk@FreeBSD.org>
To: freebsd-gnats-submit@FreeBSD.org
Subject: [PATCH] tmpfs mmap synchronization bug
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         139312
>Category:       kern
>Synopsis:       [tmpfs] [patch] tmpfs mmap synchronization bug
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    gleb
>State:          patched
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Oct 02 18:20:01 UTC 2009
>Closed-Date:    
>Last-Modified:  Tue Feb 07 22:27:35 UTC 2012
>Originator:     Gleb Kurtsou
>Release:        9-CURRENT
>Organization:
>Environment:
FreeBSD tops 9.0-CURRENT FreeBSD 9.0-CURRENT #6 r197608+311ce2b: Tue Sep 29 09:02:48 EEST 2009     root@tops:/usr/obj/usr/freebsd-src/local/sys/TOPS  amd64
>Description:
Mmaped pages can get out of sync in tmpfs.  The bug is 100% reproducible
by:
# fsx -S 125 -d /tmpfs/file
It breaks at operation 42.

Fix is inspired by zfs, it calls vm_page_cache_free(). Reading zfs
sources, it looks like it doesn't check v_object->cache, but never the
less bug never shows up on there. Probably it's because of zfs using
VOP_BMAP to do page mapping. tmpfs uses default
vop_getpages/vop_putpages which invokes vop_read/vop_write accordingly.
Removing v_object->cache == NULL checks breaks things again.

The same fix works fine in pefs (http://wiki.freebsd.org/SOC2009GlebKurtsov)
>How-To-Repeat:
# fsx -S 125 -d /tmpfs/file
It breaks at operation 42.
>Fix:


Patch attached with submission follows:

diff --git a/sys/fs/tmpfs/tmpfs_vnops.c b/sys/fs/tmpfs/tmpfs_vnops.c
index db8ceea..59d94d7 100644
--- a/sys/fs/tmpfs/tmpfs_vnops.c
+++ b/sys/fs/tmpfs/tmpfs_vnops.c
@@ -444,7 +444,8 @@ tmpfs_mappedread(vm_object_t vobj, vm_object_t tobj, size_t len, struct uio *uio
 	offset = addr & PAGE_MASK;
 	tlen = MIN(PAGE_SIZE - offset, len);
 
-	if ((vobj == NULL) || (vobj->resident_page_count == 0))
+	if ((vobj == NULL) ||
+	    (vobj->resident_page_count == 0 && vobj->cache == NULL))
 		goto nocache;
 
 	VM_OBJECT_LOCK(vobj);
@@ -555,7 +556,8 @@ tmpfs_mappedwrite(vm_object_t vobj, vm_object_t tobj, size_t len, struct uio *ui
 	offset = addr & PAGE_MASK;
 	tlen = MIN(PAGE_SIZE - offset, len);
 
-	if ((vobj == NULL) || (vobj->resident_page_count == 0)) {
+	if ((vobj == NULL) ||
+	    (vobj->resident_page_count == 0 && vobj->cache == NULL)) {
 		vpg = NULL;
 		goto nocache;
 	}
@@ -573,6 +575,8 @@ lookupvpg:
 		VM_OBJECT_UNLOCK(vobj);
 		error = uiomove_fromphys(&vpg, offset, tlen, uio);
 	} else {
+		if (__predict_false(vobj->cache != NULL))
+			vm_page_cache_free(vobj, idx, idx + 1);
 		VM_OBJECT_UNLOCK(vobj);
 		vpg = NULL;
 	}


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-fs 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Fri Oct 2 21:54:26 UTC 2009 
Responsible-Changed-Why:  

http://www.freebsd.org/cgi/query-pr.cgi?pr=139312 
Responsible-Changed-From-To: freebsd-fs->delphij 
Responsible-Changed-By: delphij 
Responsible-Changed-When: Sun Oct 4 10:34:04 UTC 2009 
Responsible-Changed-Why:  
Take. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=139312 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/139312: commit references a PR
Date: Sun,  4 Oct 2009 10:38:18 +0000 (UTC)

 Author: delphij
 Date: Sun Oct  4 10:38:04 2009
 New Revision: 197740
 URL: http://svn.freebsd.org/changeset/base/197740
 
 Log:
   Fix a bug that causes the fsx test case of mmap'ed page being out of sync
   of read/write, inspired by ZFS's counterpart.
   
   PR:		kern/139312
   Submitted by:	gk@
   MFC after:	1 week
 
 Modified:
   head/sys/fs/tmpfs/tmpfs_vnops.c
 
 Modified: head/sys/fs/tmpfs/tmpfs_vnops.c
 ==============================================================================
 --- head/sys/fs/tmpfs/tmpfs_vnops.c	Sun Oct  4 09:57:39 2009	(r197739)
 +++ head/sys/fs/tmpfs/tmpfs_vnops.c	Sun Oct  4 10:38:04 2009	(r197740)
 @@ -444,7 +444,8 @@ tmpfs_mappedread(vm_object_t vobj, vm_ob
  	offset = addr & PAGE_MASK;
  	tlen = MIN(PAGE_SIZE - offset, len);
  
 -	if ((vobj == NULL) || (vobj->resident_page_count == 0))
 +	if ((vobj == NULL) ||
 +	    (vobj->resident_page_count == 0 && vobj->cache == NULL))
  		goto nocache;
  
  	VM_OBJECT_LOCK(vobj);
 @@ -555,7 +556,8 @@ tmpfs_mappedwrite(vm_object_t vobj, vm_o
  	offset = addr & PAGE_MASK;
  	tlen = MIN(PAGE_SIZE - offset, len);
  
 -	if ((vobj == NULL) || (vobj->resident_page_count == 0)) {
 +	if ((vobj == NULL) ||
 +	    (vobj->resident_page_count == 0 && vobj->cache == NULL)) {
  		vpg = NULL;
  		goto nocache;
  	}
 @@ -573,6 +575,8 @@ lookupvpg:
  		VM_OBJECT_UNLOCK(vobj);
  		error = uiomove_fromphys(&vpg, offset, tlen, uio);
  	} else {
 +		if (__predict_false(vobj->cache != NULL))
 +			vm_page_cache_free(vobj, idx, idx + 1);
  		VM_OBJECT_UNLOCK(vobj);
  		vpg = NULL;
  	}
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: delphij 
State-Changed-When: Mon Dec 14 23:37:07 UTC 2009 
State-Changed-Why:  
Patch was applied against -HEAD on Oct 4. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=139312 
Responsible-Changed-From-To: delphij->gleb 
Responsible-Changed-By: delphij 
Responsible-Changed-When: Tue Feb 7 22:27:12 UTC 2012 
Responsible-Changed-Why:  
Change ownership to Gleb since he is the author of the original patch. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=139312 
>Unformatted:
