fs/buffer.c: add debug print for __getblk_gfp() stall problem

Among syzbot's unresolved hung task reports, 18 out of 65 reports contain
__getblk_gfp() line in the backtrace.  Since there is a comment block that
says that __getblk_gfp() will lock up the machine if try_to_free_buffers()
attempt from grow_dev_page() is failing, let's start from checking whether
syzbot is hitting that case.  This change will be removed after the bug is
fixed.

Link: http://lkml.kernel.org/r/9b9fcdda-c347-53ee-fdbb-8a7d11cf430e@I-love.SAKURA.ne.jp
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Jeff Layton <jlayton@redhat.com>
Cc: <syzkaller-bugs@googlegroups.com>
Cc: Tim Chen <tim.c.chen@linux.intel.com>
Cc: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/fs/buffer.c b/fs/buffer.c
index 32647d2011dfe05ccc12705f6b3da615b31606e9..4292762f23141fc1de0869b388482aa960ecc78e 100644 (file)
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -981,10 +981,20 @@ grow_dev_page(struct block_device *bdev, sector_t block,
                        end_block = init_page_buffers(page, bdev,
                                                (sector_t)index << sizebits,
                                                size);
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+                       current->getblk_executed |= 0x01;
+#endif
                        goto done;
                }
-               if (!try_to_free_buffers(page))
+               if (!try_to_free_buffers(page)) {
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+                       current->getblk_executed |= 0x02;
+#endif
                        goto failed;
+               }
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+               current->getblk_executed |= 0x04;
+#endif
        }
 
        /*
@@ -1004,6 +1014,9 @@ grow_dev_page(struct block_device *bdev, sector_t block,
        spin_unlock(&inode->i_mapping->private_lock);
 done:
        ret = (block < end_block) ? 1 : -ENXIO;
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+       current->getblk_executed |= 0x08;
+#endif
 failed:
        unlock_page(page);
        put_page(page);
@@ -1059,6 +1072,12 @@ __getblk_slow(struct block_device *bdev, sector_t block,
                return NULL;
        }
 
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+       current->getblk_stamp = jiffies;
+       current->getblk_executed = 0;
+       current->getblk_bh_count = 0;
+       current->getblk_bh_state = 0;
+#endif
        for (;;) {
                struct buffer_head *bh;
                int ret;
@@ -1070,6 +1089,18 @@ __getblk_slow(struct block_device *bdev, sector_t block,
                ret = grow_buffers(bdev, block, size, gfp);
                if (ret < 0)
                        return NULL;
+
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+               if (!time_after(jiffies, current->getblk_stamp + 3 * HZ))
+                       continue;
+               printk(KERN_ERR "%s(%u): getblk(): executed=%x bh_count=%d bh_state=%lx\n",
+                      current->comm, current->pid, current->getblk_executed,
+                      current->getblk_bh_count, current->getblk_bh_state);
+               current->getblk_executed = 0;
+               current->getblk_bh_count = 0;
+               current->getblk_bh_state = 0;
+               current->getblk_stamp = jiffies;
+#endif
        }
 }
 
@@ -3191,6 +3222,11 @@ EXPORT_SYMBOL(sync_dirty_buffer);
  */
 static inline int buffer_busy(struct buffer_head *bh)
 {
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+       current->getblk_executed |= 0x80;
+       current->getblk_bh_count = atomic_read(&bh->b_count);
+       current->getblk_bh_state = bh->b_state;
+#endif
        return atomic_read(&bh->b_count) |
                (bh->b_state & ((1 << BH_Dirty) | (1 << BH_Lock)));
 }
@@ -3229,11 +3265,18 @@ int try_to_free_buffers(struct page *page)
        int ret = 0;
 
        BUG_ON(!PageLocked(page));
-       if (PageWriteback(page))
+       if (PageWriteback(page)) {
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+               current->getblk_executed |= 0x10;
+#endif
                return 0;
+       }
 
        if (mapping == NULL) {          /* can this still happen? */
                ret = drop_buffers(page, &buffers_to_free);
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+               current->getblk_executed |= 0x20;
+#endif
                goto out;
        }
 
@@ -3257,6 +3300,9 @@ int try_to_free_buffers(struct page *page)
        if (ret)
                cancel_dirty_page(page);
        spin_unlock(&mapping->private_lock);
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+       current->getblk_executed |= 0x40;
+#endif
 out:
        if (buffers_to_free) {
                struct buffer_head *bh = buffers_to_free;

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6e3a5eeec509a193b5f2f3d07348a68f188a6f18..fed423b6fc0614c2ab1b7ddf4cd163bf497cab4c 100644 (file)
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1368,6 +1368,13 @@ struct task_struct {
        struct llist_head               kretprobe_instances;
 #endif
 
+#ifdef CONFIG_DEBUG_AID_FOR_SYZBOT
+       unsigned long                   getblk_stamp;
+       unsigned int                    getblk_executed;
+       unsigned int                    getblk_bh_count;
+       unsigned long                   getblk_bh_state;
+#endif
+
        /*
         * New fields for task_struct should be added above here, so that
         * they are included in the randomized portion of task_struct.

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index a8fc53d744c741ef2e2def0bf45c73c60ca95ba2..e96f4baedd28dee4e1704e1f00d98415011be8e7 100644 (file)
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1712,6 +1712,12 @@ config IO_STRICT_DEVMEM
 
 menu "$(SRCARCH) Debugging"
 
+config DEBUG_AID_FOR_SYZBOT
+       bool "Additional debug code for syzbot"
+       default n
+       help
+         This option is intended for testing by syzbot.
+
 source "arch/$(SRCARCH)/Kconfig.debug"
 
 endmenu