Commit 59a16ead authored by Hugh Dickins's avatar Hugh Dickins Committed by Linus Torvalds

tmpfs: fix spurious ENOSPC when racing with unswap

Testing the shmem_swaplist replacements for igrab() revealed another bug:
writes to /dev/loop0 on a tmpfs file which fills its filesystem were
sometimes failing with "Buffer I/O error"s.

These came from ENOSPC failures of shmem_getpage(), when racing with
swapoff: the same could happen when racing with another shmem_getpage(),
pulling the page in from swap in between our find_lock_page() and our
taking the info->lock (though not in the single-threaded loop case).

This is unacceptable, and surprising that I've not noticed it before:
it dates back many years, but (presumably) was made a lot easier to
reproduce in 2.6.36, which sited a page preallocation in the race window.

Fix it by rechecking the page cache before settling on an ENOSPC error.
Signed-off-by: default avatarHugh Dickins <>
Cc: Konstantin Khlebnikov <>
Cc: <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 778dd893
......@@ -1407,20 +1407,14 @@ repeat:
if (sbinfo->max_blocks) {
if (percpu_counter_compare(&sbinfo->used_blocks,
sbinfo->max_blocks) >= 0 ||
shmem_acct_block(info->flags)) {
error = -ENOSPC;
goto failed;
goto nospace;
inode->i_blocks += BLOCKS_PER_PAGE;
} else if (shmem_acct_block(info->flags)) {
error = -ENOSPC;
goto failed;
} else if (shmem_acct_block(info->flags))
goto nospace;
if (!filepage) {
int ret;
......@@ -1500,6 +1494,24 @@ done:
error = 0;
goto out;
* Perhaps the page was brought in from swap between find_lock_page
* and taking info->lock? We allow for that at add_to_page_cache_lru,
* but must also avoid reporting a spurious ENOSPC while working on a
* full tmpfs. (When filepage has been passed in to shmem_getpage, it
* is already in page cache, which prevents this race from occurring.)
if (!filepage) {
struct page *page = find_get_page(mapping, idx);
if (page) {
goto repeat;
error = -ENOSPC;
if (*pagep != filepage) {
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment