On Tue, 2010-02-02 at 18:17 +0300, Dmitry Monakhov wrote: > Trond Myklebust <trond.myklebust@xxxxxxxxxx> writes: > > > On Tue, 2010-02-02 at 13:36 +0300, Dmitry Monakhov wrote: > >> After page was truncated it lost it's mapping, this result in null > >> pointer dereference on bdi_stat update. In fact we have to decrement > >> bdi_stat even for truncated pages, so let's pass correct mapping in > >> function arguments. Patch against linux-2.6 > >> ##TEST_CASE > >> /* > >> Tast case for bug in nfs_clear_request_commit() > >> caused by null pointer dereference in case of truncated page. > >> It takes less than 10 minutes to reproduce the bug. > > > > Something is wrong here. nfs_release_page() returns '0' if the > > page has an associated write request (i.e. PagePrivate is set), and so > > both invalidate_complete_page() and invalidate_complete_page2() will > > fail. > > > > So what is truncating the page? > truncate_inode_page() > truncate_complete_page() > if (page_has_private(page)) > do_invalidatepage() > ->nfs_invalidate_page() do_invalidate_page() is called before remove_from_page_cache(), so page->mapping should still be set. Trond -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
