On Wed, 2014-05-21 at 14:35 -0600, Toshi Kani wrote:

On Sun, 2014-03-23 at 15:08 -0400, Matthew Wilcox wrote:
 :

quoted

+static int do_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
+			get_block_t get_block)
+{

 :

quoted

+	error = dax_get_pfn(inode, &bh, &pfn);
+	if (error > 0)
+		error = vm_insert_mixed(vma, vaddr, pfn);
+	mutex_unlock(&mapping->i_mmap_mutex);
+
+	if (page) {
+		delete_from_page_cache(page);
+		unmap_mapping_range(mapping, vmf->pgoff << PAGE_SHIFT,
+							PAGE_CACHE_SIZE, 0);
+		unlock_page(page);
+		page_cache_release(page);

Hi Matthew,

I am seeing a problem in this code path, where it deletes a page cache
page mapped to a hole. Sometimes, page->_mapcount is 0, not -1, which
leads __delete_from_page_cache(), called from delete_from_page_cache(),
to hit the following BUG_ON.

  BUG_ON(page_mapped(page))

I suppose such page has a shared mapping. Does this code need to take
care of replacing shared mappings in such case?

Hi Matthew,

The following change works in my environment.  What do you think? 

Thanks,
-Toshi

---
 fs/dax.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/dax.c b/fs/dax.c
index 2d6b4bc..046c6d6 100644
--- a/fs/dax.c
+++ b/fs/dax.c

@@ -26,6 +26,7 @@
 #include <linux/sched.h>
 #include <linux/uio.h>
 #include <linux/vmstat.h>
+#include <linux/rmap.h>
 
 int dax_clear_blocks(struct inode *inode, sector_t block, long size)
 {

@@ -385,6 +386,8 @@ static int do_dax_fault(struct vm_area_struct *vma,

struct vm_fault *vmf,
 	mutex_unlock(&mapping->i_mmap_mutex);
 
 	if (page) {
+		if (page_mapped(page))
+			try_to_unmap(page, TTU_UNMAP|TTU_IGNORE_ACCESS);
 		delete_from_page_cache(page);
 		unmap_mapping_range(mapping, vmf->pgoff << PAGE_SHIFT,
 							PAGE_CACHE_SIZE, 0);


--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>