fscache: Clear outstanding writes when disabling a cookie

dhowells · Al Viro · commit 6bdded59c893 · 2017-01-31T13:23:09.000-05:00
fscache_disable_cookie() needs to clear the outstanding writes on the
cookie it's disabling because they cannot be completed after.

Without this, fscache_nfs_open_file() gets stuck because it disables the
cookie when the file is opened for writing but can't uncache the pages till
afterwards - otherwise there's a race between the open routine and anyone
who already has it open R/O and is still reading from it.

Looking in /proc/pid/stack of the offending process shows:

[&lt;ffffffffa0142883&gt;] __fscache_wait_on_page_write+0x82/0x9b [fscache]
[&lt;ffffffffa014336e&gt;] __fscache_uncache_all_inode_pages+0x91/0xe1 [fscache]
[&lt;ffffffffa01740fa&gt;] nfs_fscache_open_file+0x59/0x9e [nfs]
[&lt;ffffffffa01ccf41&gt;] nfs4_file_open+0x17f/0x1b8 [nfsv4]
[&lt;ffffffff8117350e&gt;] do_dentry_open+0x16d/0x2b7
[&lt;ffffffff811743ac&gt;] vfs_open+0x5c/0x65
[&lt;ffffffff81184185&gt;] path_openat+0x785/0x8fb
[&lt;ffffffff81184343&gt;] do_filp_open+0x48/0x9e
[&lt;ffffffff81174710&gt;] do_sys_open+0x13b/0x1cb
[&lt;ffffffff811747b9&gt;] SyS_open+0x19/0x1b
[&lt;ffffffff81001c44&gt;] do_syscall_64+0x80/0x17a
[&lt;ffffffff8165c2da&gt;] return_from_SYSCALL_64+0x0/0x7a
[&lt;ffffffffffffffff&gt;] 0xffffffffffffffff

Reported-by: Jianhong Yin &lt;jiyin@redhat.com&gt;
Signed-off-by: David Howells &lt;dhowells@redhat.com&gt;
Acked-by: Jeff Layton &lt;jlayton@redhat.com&gt;
Acked-by: Steve Dickson &lt;steved@redhat.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
@@ -542,6 +542,7 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate)
 		hlist_for_each_entry(object, &cookie->backing_objects, cookie_link) {
 			if (invalidate)
 				set_bit(FSCACHE_OBJECT_RETIRED, &object->flags);
+			clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
 			fscache_raise_event(object, FSCACHE_OBJECT_EV_KILL);
 		}
 	} else {
@@ -560,6 +561,10 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate)
 		wait_on_atomic_t(&cookie->n_active, fscache_wait_atomic_t,
 				 TASK_UNINTERRUPTIBLE);
 
+	/* Make sure any pending writes are cancelled. */
+	if (cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX)
+		fscache_invalidate_writes(cookie);
+
 	/* Reset the cookie state if it wasn't relinquished */
 	if (!test_bit(FSCACHE_COOKIE_RELINQUISHED, &cookie->flags)) {
 		atomic_inc(&cookie->n_active);
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
@@ -645,6 +645,12 @@ static const struct fscache_state *fscache_kill_object(struct fscache_object *ob
 	fscache_mark_object_dead(object);
 	object->oob_event_mask = 0;
 
+	if (test_bit(FSCACHE_OBJECT_RETIRED, &object->flags)) {
+		/* Reject any new read/write ops and abort any that are pending. */
+		clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
+		fscache_cancel_all_ops(object);
+	}
+
 	if (list_empty(&object->dependents) &&
 	    object->n_ops == 0 &&
 	    object->n_children == 0)
