On Thu, 6 Feb 2020 18:01:32 +0900 Naohiro Aota <naohiro.aota@xxxxxxx> wrote: > claim_swapfile() currently keeps the inode locked when it is successful, or > the file is already swapfile (with -EBUSY). And, on the other error cases, > it does not lock the inode. > > This inconsistency of the lock state and return value is quite confusing > and actually causing a bad unlock balance as below in the "bad_swap" > section of __do_sys_swapon(). > > This commit fixes this issue by moving the inode_lock() and IS_SWAPFILE > check out of claim_swapfile(). The inode is unlocked in > "bad_swap_unlock_inode" section, so that the inode is ensured to be > unlocked at "bad_swap". Thus, error handling codes after the locking now > jumps to "bad_swap_unlock_inode" instead of "bad_swap". > > ===================================== > WARNING: bad unlock balance detected! > 5.5.0-rc7+ #176 Not tainted > ------------------------------------- > swapon/4294 is trying to release lock (&sb->s_type->i_mutex_key) at: > [<ffffffff8173a6eb>] __do_sys_swapon+0x94b/0x3550 > but there are no more locks to release! > > other info that might help us debug this: > no locks held by swapon/4294. > > stack backtrace: > CPU: 5 PID: 4294 Comm: swapon Not tainted 5.5.0-rc7-BTRFS-ZNS+ #176 > Hardware name: ASUS All Series/H87-PRO, BIOS 2102 07/29/2014 > Call Trace: > dump_stack+0xa1/0xea > ? __do_sys_swapon+0x94b/0x3550 > print_unlock_imbalance_bug.cold+0x114/0x123 > ? __do_sys_swapon+0x94b/0x3550 > lock_release+0x562/0xed0 > ? kvfree+0x31/0x40 > ? lock_downgrade+0x770/0x770 > ? kvfree+0x31/0x40 > ? rcu_read_lock_sched_held+0xa1/0xd0 > ? rcu_read_lock_bh_held+0xb0/0xb0 > up_write+0x2d/0x490 > ? kfree+0x293/0x2f0 > __do_sys_swapon+0x94b/0x3550 > ? putname+0xb0/0xf0 > ? kmem_cache_free+0x2e7/0x370 > ? do_sys_open+0x184/0x3e0 > ? generic_max_swapfile_size+0x40/0x40 > ? do_syscall_64+0x27/0x4b0 > ? entry_SYSCALL_64_after_hwframe+0x49/0xbe > ? lockdep_hardirqs_on+0x38c/0x590 > __x64_sys_swapon+0x54/0x80 > do_syscall_64+0xa4/0x4b0 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > RIP: 0033:0x7f15da0a0dc7 > > mm/swapfile.c | 41 ++++++++++++++++++++--------------------- > 1 file changed, 20 insertions(+), 21 deletions(-) > > diff --git a/mm/swapfile.c b/mm/swapfile.c > index bb3261d45b6a..2c4c349e1101 100644 > --- a/mm/swapfile.c > +++ b/mm/swapfile.c Look correct to me. But I don't think this code at the end of sys_swapon(): if (inode) inode_unlock(inode); will ever execute? `inode' is always NULL here?
