Mmaped pages can get out of sync in tmpfs. The bug is 100% reproducible by: # fsx -S 125 -d /tmpfs/file It breaks at operation 42. Fix is inspired by zfs, it calls vm_page_cache_free(). Reading zfs sources, it looks like it doesn't check v_object->cache, but never the less bug never shows up on there. Probably it's because of zfs using VOP_BMAP to do page mapping. tmpfs uses default vop_getpages/vop_putpages which invokes vop_read/vop_write accordingly. Removing v_object->cache == NULL checks breaks things again. The same fix works fine in pefs (http://wiki.freebsd.org/SOC2009GlebKurtsov) Fix: Patch attached with submission follows: How-To-Repeat: # fsx -S 125 -d /tmpfs/file It breaks at operation 42.
Responsible Changed From-To: freebsd-bugs->freebsd-fs
Responsible Changed From-To: freebsd-fs->delphij Take.
Author: delphij Date: Sun Oct 4 10:38:04 2009 New Revision: 197740 URL: http://svn.freebsd.org/changeset/base/197740 Log: Fix a bug that causes the fsx test case of mmap'ed page being out of sync of read/write, inspired by ZFS's counterpart. PR: kern/139312 Submitted by: gk@ MFC after: 1 week Modified: head/sys/fs/tmpfs/tmpfs_vnops.c Modified: head/sys/fs/tmpfs/tmpfs_vnops.c ============================================================================== --- head/sys/fs/tmpfs/tmpfs_vnops.c Sun Oct 4 09:57:39 2009 (r197739) +++ head/sys/fs/tmpfs/tmpfs_vnops.c Sun Oct 4 10:38:04 2009 (r197740) @@ -444,7 +444,8 @@ tmpfs_mappedread(vm_object_t vobj, vm_ob offset = addr & PAGE_MASK; tlen = MIN(PAGE_SIZE - offset, len); - if ((vobj == NULL) || (vobj->resident_page_count == 0)) + if ((vobj == NULL) || + (vobj->resident_page_count == 0 && vobj->cache == NULL)) goto nocache; VM_OBJECT_LOCK(vobj); @@ -555,7 +556,8 @@ tmpfs_mappedwrite(vm_object_t vobj, vm_o offset = addr & PAGE_MASK; tlen = MIN(PAGE_SIZE - offset, len); - if ((vobj == NULL) || (vobj->resident_page_count == 0)) { + if ((vobj == NULL) || + (vobj->resident_page_count == 0 && vobj->cache == NULL)) { vpg = NULL; goto nocache; } @@ -573,6 +575,8 @@ lookupvpg: VM_OBJECT_UNLOCK(vobj); error = uiomove_fromphys(&vpg, offset, tlen, uio); } else { + if (__predict_false(vobj->cache != NULL)) + vm_page_cache_free(vobj, idx, idx + 1); VM_OBJECT_UNLOCK(vobj); vpg = NULL; } _______________________________________________ svn-src-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
State Changed From-To: open->patched Patch was applied against -HEAD on Oct 4.
Responsible Changed From-To: delphij->gleb Change ownership to Gleb since he is the author of the original patch.
Fix in r197740 was committed before /stable/9 branched. So all releases since 9.0 already include the fix. Closing as fixed.