On Fri, Jul 31, 2020 at 9:05 AM Jeff Layton <jlayton@xxxxxxxxxx> wrote: > +static int ceph_readpages(struct file *file, struct address_space *mapping, > + struct list_head *page_list, unsigned nr_pages) > { ... > + int max = fsc->mount_options->rsize >> PAGE_SHIFT; ... > + ret = fscache_read_helper_page_list(&req->fscache_req, page_list, max); Looks like the root of my problems is that the 'max_pages' parameter given to fscache_read_helper_page_list() does not work for purposes of limiting the IO to the 'rsize'. That is, the fscache_io_request.nr_pages exceeds 'max_pages' and becomes readahead_size. So even though max_pages is based on 'rsize', when issue_op() is called, it is for a fscache_io_request that exceeds 'rsize', resulting in multiple NFS reads that go over the wire and multiple completions, each of which end up calling back into io_done() which blows up because fscache does not expect this. Looks like fscache_shape_request() overrides any 'max_pages' value (actually it is cachefiles_shape_request) , so it's unclear why the netfs would pass in a 'max_pages' if it is not honored - seems like a bug maybe or it's not obvious what the purpose is there. I tried a custom 'shape' method and got further, but it blew up on another test, so I'm not sure. It would be good to know if this somehow works for you but my guess is you'll see similar failures when rsize < readahead_size == size_of_readpages.