【OLK-6.6】shmem：swap测试i_block异常的告警

> _**请尽量提供详细的信息，如缺乏必要的定位信息，则缺陷不会被定位**_

## 环境信息

【OS版本】（如openEuler-22.03-LTS，参考命令"cat /etc/os-release"结果）
OLK-6.6

【内核版本】（如kernel-5.10.0-60.138.0.165，参考命令"uname -r"结果）
OLK-6.6

【硬件平台】（缺陷相关的硬件信息，如：处理器型号、内存、磁盘、网卡、BIOS 等信息）

【组网信息】（和网络、性能相关的问题，应该说明详细的组网和场景信息）

## 缺陷信息

【问题复现步骤】
1. 执行脚本
```
stress_test_time=72000
folio_sizes=(16 32 64 128 256 512 1024 2048)
folio_anon_private_options=(always inherit madvise never)
folio_anon_shared_options=(always inherit within_size advise never)

folio_interface(){
    case $1 in
        anon) 
            # $2 size $3 option
            echo $3 > /sys/kernel/mm/transparent_hugepage/hugepages-"$2"kB/enabled
            ;;
        shmem)
            # $2 size $3 option
            echo $3 > /sys/kernel/mm/transparent_hugepage/hugepages-"$2"kB/shmem_enabled
            ;;
        *)
            tst_res TINFO "Wrong folio interface input $1"
            ;;
    esac
}

folio_02_swap(){
    # ./folio_test 并发测试子进程数 单进程每个规格的folio页申请个数 测试的时长
    ./folio_swap 20 $stress_test_time
}

folio_03_folio_size_option(){
    local size option
    while true; do
        for size in ${folio_sizes[@]}; do
            for option in ${folio_anon_private_options[@]}; do
                folio_interface anon $size $option
                sleep 1
            done
            for option in ${folio_anon_shared_options[@]}; do
                folio_interface shmem $size $option
                sleep 1
            done
        done
    done
}
folio_07_memory_compact(){
    while true; do 
        echo 1 > /proc/sys/vm/compact_memory 
        sleep 3
    done
}

main(){
    mkdir /mnt/test
    mkdir /mnt/swap

swapoff -a
    modprobe zram
    cat /sys/class/zram-control/hot_add
    echo 50G > /sys/block/zram0/disksize
    mkswap /dev/zram0
    swapon /dev/zram0

folio_02_swap &

for i in $(seq 1 10); do
        folio_03_folio_size_option &
        folio_07_memory_compact &
    done

sleep $stress_test_time
}

main
```
```
#include <sys/mman.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ipc.h>
#include <sys/shm.h>
#include <signal.h>

/* folio不同规格页的申请函数 */
int folio_pageout(int size, int num){
    int fd, i, j;
    char filename[64], file_id[64];
    char *addr[num];

for (i = 0; i < num; i++) {
        addr[i] = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
        if (addr[i] == MAP_FAILED) {
            perror("mmap failed");
            return -1;
        }
    }

for (j=0; j<3; j++){
	for (i=0; i<num; i++){
            memset(addr[i], 1, size);
        }
    }

// folio页 写操作+swap换出 重复执行
    for (j=0; j<3; j++){
        for (i=0; i<num; i++){
            memset(addr[i], 1, size/4);     
        }
        for (i=0; i<num; i++){
            madvise(addr[i], size, MADV_PAGEOUT);       
        }
    }

// 解除映射
    for (i=0; i<num; i++) {
        munmap(addr[i], size);
    }
}

int folio_pageout_stress(int num){
    int i,j;
    int size = 4096;
    for (i=0; i<11; i++) {
        folio_pageout(size, num);
        size *= 2;
    }
    size = 4194303; // 4M-1
    folio_pageout(size, num);
}

int folio_pageout_test(int *arr_folio_pageout_stress, int stress_num, int folio_num){
    for(int i=0; i<stress_num; i++){
        pid_t pid = fork();
        if (pid == 0){
            while(1){
                folio_pageout_stress(folio_num);
            }
        } else if (pid > 0){
            arr_folio_pageout_stress[i] = pid;
        }
    }
}

int folio_clean(int *arr_folio_pageout_stress, int stress_num){
    for(int i=0; i<stress_num; i++){
        kill(arr_folio_pageout_stress[i], SIGKILL);
    }
}

int main(int argc, char **argv){
    int stress_num = atoi(argv[1]);
    int test_time = atoi(argv[2]);

int arr_folio_pageout_stress[stress_num];
    
    // 单加压进程 申请读写的最大内存量为1G
    folio_pageout_test(arr_folio_pageout_stress, stress_num, 256);
    sleep(test_time);
    folio_clean(arr_folio_pageout_stress, stress_num);
}
```

【实际结果】请描述出问题的结果和影响
有WARNING报错，且概率触发内核panic。详见附件信息。

【期望结果】请描述出期望的结果和影响

【其他相关附件信息】比如 syslog、dmesg、panic、lockup、kdump 信息、图片等

```
WARNING: CPU: 27 PID: 2560 at mm/shmem.c:1298 shmem_evict_inode+0x206/0x240
CPU: 27 PID: 2560 Comm: folio_swap Kdump: loaded Tainted: G        W          6.6.0+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:shmem_evict_inode+0x206/0x240
Call Trace:
...
evict+0xd6/0x180
__dentry_kill+0xe3/0x190
dentry_kill+0x4d/0x250
dput+0x1b3/0x210
__fput+0x13b/0x2a0
task_work_run+0x58/0x90
syscall_exit_to_user_mode+0x1d0/0x1e0
do_syscall_64+0x62/0x100
entry_SYSCALL_64_after_hwframe+0x78/0xe2
...
```
```
watchdog: BUG: soft lockup - CPU#17 stuck for 22s! [folio_swap:2439]
Modules linked in: zram xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrty
 sunrpc intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfi
 jbd2 sr_mod cdrom ata_generic crct10dif_pclmul crc32_pclmul crc32c_intel ata_piix ghash_c
CPU: 17 PID: 2439 Comm: folio_swap Kdump: loaded Tainted: G             L     6.6.0+ #51
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:filemap_get_entry+0x7f/0x130
Code: 06 04 00 00 74 e4 48 3d 02 04 00 00 74 dc 48 85 c0 0f 84 a1 00 00 00 a8 01 75 4b 8b 
RSP: 0018:ffffa53842d73c60 EFLAGS: 00000246
RAX: 0000000000000080 RBX: 00000000000000c0 RCX: 0000000000000000
RDX: 0000000000000081 RSI: ffff8ececaa6f908 RDI: ffffdeab90c7a000
RBP: 0000000000000002 R08: 00000000000345b0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffa53842d73d48
R13: ffff8ecf30f1f5f0 R14: ffff8ecf3b2b6730 R15: ffffa53842d73df8
FS:  00007f64782d2740(0000) GS:ffff8ecff7680000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f64683d1000 CR3: 00000002492f0003 CR4: 0000000000770ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <IRQ>
 ? watchdog_timer_fn+0x1b4/0x220
 ? __run_hrtimer+0x59/0x190
 ? __hrtimer_run_queues+0x77/0xe0
 ? hrtimer_interrupt+0xf4/0x230
 ? __sysvec_apic_timer_interrupt+0x46/0xe0
 ? sysvec_apic_timer_interrupt+0x69/0x90
 </IRQ>
 <TASK>
 ? asm_sysvec_apic_timer_interrupt+0x16/0x20
 ? filemap_get_entry+0x7f/0x130
 shmem_get_folio_gfp+0xa5/0x6a0
 shmem_fault+0x7f/0x120
 __do_fault+0x36/0x1f0
 do_shared_fault+0x29/0x160
 do_fault+0x40/0x140
 __handle_mm_fault+0x5bf/0x780
 ? __pfx_tick_sched_timer+0x10/0x10
 handle_mm_fault+0x1ae/0x350
 exc_page_fault+0x1ec/0x730
 asm_exc_page_fault+0x22/0x30
RIP: 0033:0x7f647845fd20
```

```
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0xbf400
head: order:9 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8ece066b5000
flags: 0x3fffff00080040(head|swapbacked|node=0|zone=1|lastcpupid=0x1fffff)
raw: 003fffff00080040 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000001 0000000000000000 00000001ffffffff ffff8ece066b5000
head: 003fffff00080040 0000000000000000 dead000000000122 0000000000000000
head: 0000000000000001 0000000000000000 00000001ffffffff ffff8ece066b5000
head: 003fffff00000209 ffffdeab82fd0001 dead000000000122 00000000ffffffff
head: 0000020000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))
------------[ cut here ]------------
kernel BUG at mm/shmem.c:800!
invalid opcode: 0000 [#1] SMP PTI
CPU: 5 PID: 2437 Comm: folio_swap Kdump: loaded Tainted: G             L     6.6.0+ #51
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:shmem_add_to_page_cache+0x229/0x280
Code: be 01 00 00 00 e9 f4 fe ff ff 48 c7 c6 00 08 b0 96 48 89 df e8 a8 3d 02 00 0f 0b 48 
RSP: 0000:ffffa53842d6bbc0 EFLAGS: 00010246
RAX: 000000000000003f RBX: ffffdeab82fd0000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8ecdf78a1000 RDI: ffff8ecdf78a1000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffa53842d6ba78
R10: 0000000000000003 R11: ffffffff975e6988 R12: 00000000000820c0
R13: ffff8ecd143c6208 R14: 0000000000000200 R15: ffffdeab82fd0000
FS:  00007f64782d2740(0000) GS:ffff8ecdf7880000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6467000000 CR3: 0000000244a1e002 CR4: 0000000000770ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 ? die+0x32/0x80
 ? do_trap+0xd6/0x100
 ? shmem_add_to_page_cache+0x229/0x280
 ? do_error_trap+0x65/0x80
 ? shmem_add_to_page_cache+0x229/0x280
 ? exc_invalid_op+0x4c/0x60
 ? shmem_add_to_page_cache+0x229/0x280
 ? asm_exc_invalid_op+0x16/0x20
 ? shmem_add_to_page_cache+0x229/0x280
 shmem_alloc_and_add_folio+0x23d/0x460
 shmem_get_folio_gfp+0x366/0x6a0
 shmem_fault+0x7f/0x120
 __do_fault+0x36/0x1f0
 ? free_unref_page+0x11d/0x1b0
 do_shared_fault+0x29/0x160
 do_fault+0x40/0x140
 __handle_mm_fault+0x5bf/0x780
 ? __pfx_tick_sched_timer+0x10/0x10
 handle_mm_fault+0x1ae/0x350
 exc_page_fault+0x1ec/0x730
 asm_exc_page_fault+0x22/0x30
RIP: 0033:0x7f647845fc6e
```
【已分析信息】如已经做过分析和定位，请尽量附上详细的分析结果
**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

GVP openEuler/kernel

内容风险标识

评论 (6)

GVPopenEuler/kernel

内容风险标识