On Mon, Nov 02, 2020 at 02:00:08PM -0500, Kent Overstreet wrote:
(snipped the deleted lines for clarity)
> > if (iocb->ki_flags & IOCB_WAITQ) {
> > + error = lock_page_async(page, iocb->ki_waitq);
> > + if (error) {
> > + put_page(page);
> > + return ERR_PTR(error);
> > + }
> > } else {
> > + if (!trylock_page(page)) {
> > + put_and_wait_on_page_locked(page, TASK_KILLABLE);
> > + return NULL;
> > + }
> > }
> >
> > + if (!page->mapping)
> > + goto truncated;
>
> Since we're dropping our ref to the page, it could potentially be truncated and
> then reused, no? So we should be checking page->mapping == mapping &&
> page->index == index (and stashing page->index before dropping our ref, or
> passing it in).
If we get to this point, then we _didn't_ drop our ref to the page.
All the paths above that call put_page() then return.
