On Thu, May 19, 2022 at 08:50:29PM +0800, Miaohe Lin wrote: > When swap in shmem error at swapoff time, there would be a infinite loop > in the while loop in shmem_unuse_inode(). It's because swapin error is > deliberately ignored now and thus info->swapped will never reach 0. So > we can't escape the loop in shmem_unuse(). > > In order to fix the issue, swapin_error entry is stored in the mapping > when swapin error occurs. So the swapcache page can be freed and the > user won't end up with a permanently mounted swap because a sector is > bad. If the page is accessed later, the user process will be killed > so that corrupted data is never consumed. On the other hand, if the > page is never accessed, the user won't even notice it. > > Reported-by: Naoya Horiguchi <naoya.horiguchi@xxxxxxx> > Signed-off-by: Miaohe Lin <linmiaohe@xxxxxxxxxx> Hi Miaohe, Thank you for the update. I might miss something, but I still see the same problem (I checked it on mm-everything-2022-05-19-00-03 + this patchset). This patch has the effect to change the return value of shmem_swapin_folio(), -EIO (without this patch) to -EEXIST (with this patch). But shmem_unuse_swap_entries() checks neither, so no change from caller's view point. Maybe breaking in errors (rather than ENOMEM) in for loop in shmem_unuse_swap_entries() solves the issue? I briefly checked with the below change, then swapoff can return with failure. @@ -1222,7 +1222,7 @@ static int shmem_unuse_swap_entries(struct inode *inode, folio_put(folio); ret++; } - if (error == -ENOMEM) + if (error < 0) break; error = 0; } > --- > mm/shmem.c | 39 +++++++++++++++++++++++++++++++++++++++ > 1 file changed, 39 insertions(+) > > diff --git a/mm/shmem.c b/mm/shmem.c > index d3c7970e0179..d55dd972023a 100644 > --- a/mm/shmem.c > +++ b/mm/shmem.c > @@ -1175,6 +1175,10 @@ static int shmem_find_swap_entries(struct address_space *mapping, > continue; > > entry = radix_to_swp_entry(folio); > + /* > + * swapin error entries can be found in the mapping. But they're > + * deliberately ignored here as we've done everything we can do. > + */ > if (swp_type(entry) != type) > continue; > > @@ -1672,6 +1676,36 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp, > return error; > } > > +static void shmem_set_folio_swapin_error(struct inode *inode, pgoff_t index, > + struct folio *folio, swp_entry_t swap) > +{ > + struct address_space *mapping = inode->i_mapping; > + struct shmem_inode_info *info = SHMEM_I(inode); > + swp_entry_t swapin_error; > + void *old; > + > + swapin_error = make_swapin_error_entry(&folio->page); > + old = xa_cmpxchg_irq(&mapping->i_pages, index, > + swp_to_radix_entry(swap), > + swp_to_radix_entry(swapin_error), 0); > + if (old != swp_to_radix_entry(swap)) > + return; > + > + folio_wait_writeback(folio); > + delete_from_swap_cache(&folio->page); > + spin_lock_irq(&info->lock); > + /* > + * Don't treat swapin error folio as alloced. Otherwise inode->i_blocks won't > + * be 0 when inode is released and thus trigger WARN_ON(inode->i_blocks) in > + * shmem_evict_inode. > + */ > + info->alloced--; > + info->swapped--; > + shmem_recalc_inode(inode); > + spin_unlock_irq(&info->lock); > + swap_free(swap); > +} > + > /* > * Swap in the page pointed to by *pagep. > * Caller has to make sure that *pagep contains a valid swapped page. (off-topic a little) BTW, the comment on shmem_swapin_folio() still mentions *pagep, but maybe it can be updated to *foliop. Thanks, Naoya Horiguchi > @@ -1695,6 +1729,9 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index, > swap = radix_to_swp_entry(*foliop); > *foliop = NULL; > > + if (is_swapin_error_entry(swap)) > + return -EIO; > + > /* Look it up and read it in.. */ > page = lookup_swap_cache(swap, NULL, 0); > if (!page) { > @@ -1762,6 +1799,8 @@ static int shmem_swapin_folio(struct inode *inode, pgoff_t index, > failed: > if (!shmem_confirm_swap(mapping, index, swap)) > error = -EEXIST; > + if (error == -EIO) > + shmem_set_folio_swapin_error(inode, index, folio, swap);