tmpfs: change final i_blocks BUG to WARNING

Under a particular load on one machine, I have hit shmem_evict_inode()'s
BUG_ON(inode->i_blocks), enough times to narrow it down to a particular
race between swapout and eviction.

It comes from the "if (freed > 0)" asymmetry in shmem_recalc_inode(), and
the lack of coherent locking between mapping's nrpages and shmem's swapped
count.  There's a window in shmem_writepage(), between lowering nrpages in
shmem_delete_from_page_cache() and then raising swapped count, when the
freed count appears to be +1 when it should be 0, and then the asymmetry
stops it from being corrected with -1 before hitting the BUG.

One answer is coherent locking: using tree_lock throughout, without
info->lock; reasonable, but the raw_spin_lock in percpu_counter_add() on
used_blocks makes that messier than expected.  Another answer may be a
further effort to eliminate the weird shmem_recalc_inode() altogether, but
previous attempts at that failed.

So far undecided, but for now change the BUG_ON to WARN_ON: in usual
circumstances it remains a useful consistency check.

Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

tmpfs: fix shmem_getpage_gfp VM_BUG_ON

Fuzzing with trinity hit the "impossible" VM_BUG_ON(error) (which Fedora
has converted to WARNING) in shmem_getpage_gfp():

WARNING: at mm/shmem.c:1151 shmem_getpage_gfp+0xa5c/0xa70()
Pid: 29795, comm: trinity-child4 Not tainted 3.7.0-rc2+ #49
Call Trace:
 [<ffffffff8107100f>] warn_slowpath_common+0x7f/0xc0
 [<ffffffff8107106a>] warn_slowpath_null+0x1a/0x20
 [<ffffffff811903fc>] shmem_getpage_gfp+0xa5c/0xa70
 [<ffffffff81190e4f>] shmem_fault+0x4f/0xa0
 [<ffffffff8119f391>] __do_fault+0x71/0x5c0
 [<ffffffff811a2767>] handle_pte_fault+0x97/0xae0
 [<ffffffff811a4a39>] handle_mm_fault+0x289/0x350
 [<ffffffff816d091e>] __do_page_fault+0x18e/0x530
 [<ffffffff816d0ceb>] do_page_fault+0x2b/0x50
 [<ffffffff816cd3b8>] page_fault+0x28/0x30
 [<ffffffff816d5688>] tracesys+0xe1/0xe6

Thanks to Johannes for pointing to truncation: free_swap_and_cache() only
does a trylock on the page, so the page lock we've held since before
confirming swap is not enough to protect against truncation.

What cleanup is needed in this case?  Just delete_from_swap_cache(), which
takes care of the memcg uncharge.

Reported-by: Dave Jones <davej@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

Merge branch 'akpm-current/current'

Merge remote-tracking branch 'drop-experimental/linux-next'

Conflicts:
drivers/net/ethernet/intel/Kconfig
drivers/ptp/Kconfig

Merge remote-tracking branch 'lzo-update/lzo-update'

Merge remote-tracking branch 'random/dev'

Merge remote-tracking branch 'clk/clk-next'

Merge remote-tracking branch 'signal/for-next'

Conflicts:
arch/arm/kernel/process.c
arch/sparc/kernel/sys_sparc_64.c

Merge remote-tracking branch 'dma-buf/for-next'

Merge remote-tracking branch 'pwm/for-next'

Merge remote-tracking branch 'kvmtool/master'

Merge remote-tracking branch 'tegra/for-next'

Merge remote-tracking branch 'samsung/for-next'

Merge remote-tracking branch 'renesas/next'

Merge remote-tracking branch 'ixp4xx/next'

Merge remote-tracking branch 'ep93xx/ep93xx-for-next'

Merge remote-tracking branch 'cortex/for-next'

Merge remote-tracking branch 'bcm2835/for-next'

Merge remote-tracking branch 'arm-soc/for-next'

Conflicts:
arch/arm/Kconfig
arch/arm/mach-nomadik/board-nhk8815.c
arch/arm/mach-omap2/drm.c
arch/arm/mach-ux500/board-mop500-audio.c
arch/arm/mach-ux500/board-mop500.c
arch/arm/mach-ux500/cpu-db8500.c
drivers/pinctrl/pinctrl-nomadik.c

Merge remote-tracking branch 'gpio-lw/for-next'

Merge remote-tracking branch 'vhost/linux-next'

Conflicts:
drivers/net/tun.c

Merge remote-tracking branch 'pinctrl/for-next'

Conflicts:
arch/arm/boot/dts/spear1340.dtsi

Merge remote-tracking branch 'char-misc/char-misc-next'

Merge remote-tracking branch 'staging/staging-next'

Conflicts:
drivers/staging/telephony/Kconfig

Merge remote-tracking branch 'usb/usb-next'

Conflicts:
drivers/usb/early/ehci-dbgp.c

Merge remote-tracking branch 'tty/tty-next'

Conflicts:
drivers/tty/serial/omap-serial.c

Merge remote-tracking branch 'driver-core/driver-core-next'

Merge remote-tracking branch 'leds/for-next'

Merge remote-tracking branch 'regmap/for-next'

Merge remote-tracking branch 'drivers-x86/linux-next'

Merge remote-tracking branch 'workqueues/for-next'

Merge remote-tracking branch 'percpu/for-next'

Merge remote-tracking branch 'xen-two/linux-next'

Merge remote-tracking branch 'kvm-ppc/kvm-ppc-next'

Conflicts:
arch/powerpc/include/asm/Kbuild
arch/powerpc/include/uapi/asm/Kbuild
arch/powerpc/include/uapi/asm/epapr_hcalls.h

Merge remote-tracking branch 'kvm/linux-next'

Merge remote-tracking branch 'rcu/rcu/next'

Merge remote-tracking branch 'tip/auto-latest'

Merge remote-tracking branch 'spi-mb/spi-next'

Merge remote-tracking branch 'dt-rh/for-next'

Merge remote-tracking branch 'edac-amd/for-next'

Merge remote-tracking branch 'edac/linux_next'

Merge remote-tracking branch 'fsnotify/for-next'

Conflicts:
kernel/audit_tree.c

Merge remote-tracking branch 'pm/linux-next'

Conflicts:
arch/x86/pci/acpi.c

Merge remote-tracking branch 'trivial/for-next'

Merge remote-tracking branch 'osd/linux-next'

Merge remote-tracking branch 'iommu/next'

Merge remote-tracking branch 'watchdog/master'

Merge remote-tracking branch 'selinux/master'

Merge remote-tracking branch 'security/next'

Conflicts:
fs/cifs/cifsacl.c
net/dns_resolver/dns_key.c
security/keys/keyctl.c
security/keys/keyring.c
security/keys/process_keys.c

Merge remote-tracking branch 'regulator/for-next'

Merge remote-tracking branch 'mfd/for-next'

Merge remote-tracking branch 'md/for-next'

Merge remote-tracking branch 'slab/for-next'

Conflicts:
mm/slob.c

Merge remote-tracking branch 'kgdb/kgdb-next'

Merge remote-tracking branch 'mmc/mmc-next'

Merge branch 'device-mapper/master'

Merge remote-tracking branch 'block/for-next'

Merge remote-tracking branch 'cgroup/for-next'

Merge remote-tracking branch 'input/next'

Merge remote-tracking branch 'virtio/virtio-next'

Merge remote-tracking branch 'modules/modules-next'

Merge remote-tracking branch 'sound-asoc/for-next'

Merge remote-tracking branch 'sound/for-next'

Merge remote-tracking branch 'drm/drm-next'

Merge remote-tracking branch 'crypto/master'

Merge remote-tracking branch 'l2-mtd/master'

Merge remote-tracking branch 'mtd/master'

Merge remote-tracking branch 'bluetooth/master'

Merge remote-tracking branch 'wireless-next/master'

Merge remote-tracking branch 'net-next/master'

Merge remote-tracking branch 'slave-dma/next'

Merge remote-tracking branch 'target-updates/for-next'

Merge remote-tracking branch 'swiotlb/linux-next'

Merge remote-tracking branch 'dlm/next'

Merge remote-tracking branch 'ubi/linux-next'

Merge remote-tracking branch 'thermal/next'

Merge remote-tracking branch 'cpuidle/cpuidle-next'

Conflicts:
drivers/cpuidle/coupled.c
include/linux/cpuidle.h

Merge remote-tracking branch 'acpi/next'

Merge remote-tracking branch 'kbuild/for-next'

Merge commit 'refs/next/20121026/v4l-dvb'

Merge remote-tracking branch 'hwmon-staging/hwmon-next'

Merge branch 'jdelvare-hwmon/master'

Merge remote-tracking branch 'i2c-embedded/i2c-embedded/for-next'

Merge branch 'i2c/master'

Merge remote-tracking branch 'hid/for-next'

Merge remote-tracking branch 'pci/next'

Merge remote-tracking branch 'vfs/for-next'

Merge remote-tracking branch 'xfs/for-next'

Merge remote-tracking branch 'ubifs/linux-next'

Merge remote-tracking branch 'v9fs/for-next'

Merge remote-tracking branch 'ocfs2/linux-next'

Merge remote-tracking branch 'nfsd/nfsd-next'

Merge remote-tracking branch 'nfs/linux-next'

Merge remote-tracking branch 'logfs/master'

Merge remote-tracking branch 'gfs2/master'

Merge remote-tracking branch 'fuse/for-next'

Merge remote-tracking branch 'ext4/dev'

Merge remote-tracking branch 'ecryptfs/next'

Merge remote-tracking branch 'cifs/for-next'

Merge remote-tracking branch 'ceph/master'