Busy buffers and try_to_free_pages

[Steve Lord]

I am chasing around in circles with an issue where buffers pointing at
highmem pages are getting put onto the buffer free list, and later on
causing oops in ext2 when it gets assigned them for metadata via getblk.

Say one thread is performing a truncate on an inode and is currently in
truncate_inode_pages walking the pages and removing them from the
address space of the inode. If the try_to_free_buffers call fails to remove
the buffers from the page because the buffer_busy test fails, then
the buffers become anonymous and we disconnet the page from the address
space anyway. During unmount, these anonymous buffers get put on the free
list. A simple sync call running in parallel with the truncate can cause
the buffer to be seen as busy and get the system into this state.

What is supposed to prevent this from happening? It seems that pages
allocated from highmem should never be allowed to be cleaned up this
way.

Steve