From patchwork Fri Apr 26 21:54:48 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645408 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD35C2C68A for ; Fri, 26 Apr 2024 21:55:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168552; cv=none; b=phAIKFXVDdDH4ek+J1H+TzXDcQZA0ItjbLyooEus8YfyjuiOe99Jbq1KR1psFMj34ON4Ol3HSjfKvStTwC8OoeOAg9HkkeotjdvNNJ240ezXRJfSpf8D3QbxPOOvoGNOTFYkuflBhzUevevpGSjsDbh6SJEi7YTMh8eXzDDrLR0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168552; c=relaxed/simple; bh=W/RqA4penfSt2iR1R5P1X3duWqQqT2Rk2QKzYlngOV4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aV11QNHJWUymdFUpKJiQhsEhYXL3sQOClA/v23+M8aFQv9w0H5lHbK8tC6YZ/ZGgE490wkC8Lm6ZQ5mbznDU7fVqTeBadtEcfElPhq8Phz7xTp9WfdqgX0sfMLdVkpzc+XYJ0KIP26h0LjV7K0rAt1no0aJUVvFrdNLWURWjGzo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Dks9Xrnx; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Dks9Xrnx" Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-1e8bbcbc2b7so24572535ad.0 for ; Fri, 26 Apr 2024 14:55:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168550; x=1714773350; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=7UbSJnNLr2zr485iBx6ewge0tt/tQzvK4CN6pAWgtqA=; b=Dks9XrnxmahWoWLWTv9f1DOAkhrBH5poIcxnySu5In2fyYf3PY7mpE2WbryJF6e3TL SZP2K6IYVDzyNxJLv//PAuE1/+RQeQjK7/R4Z20miT/Qqu7w0LXFTaQ1nwgjS+yWr3IX xLhgg3yNwegTKwatQiSQOkiXAjaYBWOgBaUfO+k/wMW5WFJrgPd8UwD3/0BfrqnGfmBs vyi4+/wsNpj3AjZ1464NURVEQpcRK1QSk3/Y3K/ZAKMg8xtw7qmW5Uo1amwtn8tGJgiD TClgG4jFo6yBLbf4zdouy0NL0vpLhjkDdpgZr0DiZvOPVnV1TXmJdyXuH4nQ4emupAdW sU1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168550; x=1714773350; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=7UbSJnNLr2zr485iBx6ewge0tt/tQzvK4CN6pAWgtqA=; b=CvbYzEJWMcollEf0jtCtg+PucZVLcwwHzJUIxcE4iqHhSlzQmNiJScApfEkdWV6Ik1 OeMfhPQouyaNByfUTKbRbfuxQIJoMn5PLncGHBfi+ms6YTKgX1X5QT0r1/qNiQDE0hXu lBe7moEhOxbsymaRQwPHC+6AD2uWHJ9zULuCVxiakzr/RvR0Wb/zzzi7JadiJsuXTnkh w3+qgZFxw2L8867kYbQvHZJHUhGOc5vrQpHNyF9gIfqbCJANPcN5gjSB6E9Itd9ej4Qf S7TUR2j2AhlyBVVgImO2W+RcEyHpRZzBg6lGWJZCik+MwcVoI2gj1FBfGrDIih0rObXU 2NDQ== X-Gm-Message-State: AOJu0Yw2trgesZ/3+N/4FyaCORfBZoPkHXBUlnkbJ6cAiuYhcEapq/5H FnGoLE59CAfbo2IdW/7eiaq/M6vW1uHiBI30eBlI/U42onLWLqAl59vW5WWJ X-Google-Smtp-Source: AGHT+IGrhAdm0cC7jpboPIEo9+fO6sqpZOpAwtwSL6fG8bp9IUe6M/GdJOlZNu+jly0WusgPUyCMhg== X-Received: by 2002:a17:902:da8a:b0:1e4:a667:5528 with SMTP id j10-20020a170902da8a00b001e4a6675528mr5304051plx.3.1714168549820; Fri, 26 Apr 2024 14:55:49 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:33 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , Christoph Hellwig , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 01/24] xfs: write page faults in iomap are not buffered writes Date: Fri, 26 Apr 2024 14:54:48 -0700 Message-ID: <20240426215512.2673806-2-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit 118e021b4b66f758f8e8f21dc0e5e0a4c721e69e ] When we reserve a delalloc region in xfs_buffered_write_iomap_begin, we mark the iomap as IOMAP_F_NEW so that the the write context understands that it allocated the delalloc region. If we then fail that buffered write, xfs_buffered_write_iomap_end() checks for the IOMAP_F_NEW flag and if it is set, it punches out the unused delalloc region that was allocated for the write. The assumption this code makes is that all buffered write operations that can allocate space are run under an exclusive lock (i_rwsem). This is an invalid assumption: page faults in mmap()d regions call through this same function pair to map the file range being faulted and this runs only holding the inode->i_mapping->invalidate_lock in shared mode. IOWs, we can have races between page faults and write() calls that fail the nested page cache write operation that result in data loss. That is, the failing iomap_end call will punch out the data that the other racing iomap iteration brought into the page cache. This can be reproduced with generic/34[46] if we arbitrarily fail page cache copy-in operations from write() syscalls. Code analysis tells us that the iomap_page_mkwrite() function holds the already instantiated and uptodate folio locked across the iomap mapping iterations. Hence the folio cannot be removed from memory whilst we are mapping the range it covers, and as such we do not care if the mapping changes state underneath the iomap iteration loop: 1. if the folio is not already dirty, there is no writeback races possible. 2. if we allocated the mapping (delalloc or unwritten), the folio cannot already be dirty. See #1. 3. If the folio is already dirty, it must be up to date. As we hold it locked, it cannot be reclaimed from memory. Hence we always have valid data in the page cache while iterating the mapping. 4. Valid data in the page cache can exist when the underlying mapping is DELALLOC, UNWRITTEN or WRITTEN. Having the mapping change from DELALLOC->UNWRITTEN or UNWRITTEN->WRITTEN does not change the data in the page - it only affects actions if we are initialising a new page. Hence #3 applies and we don't care about these extent map transitions racing with iomap_page_mkwrite(). 5. iomap_page_mkwrite() checks for page invalidation races (truncate, hole punch, etc) after it locks the folio. We also hold the mapping->invalidation_lock here, and hence the mapping cannot change due to extent removal operations while we are iterating the folio. As such, filesystems that don't use bufferheads will never fail the iomap_folio_mkwrite_iter() operation on the current mapping, regardless of whether the iomap should be considered stale. Further, the range we are asked to iterate is limited to the range inside EOF that the folio spans. Hence, for XFS, we will only map the exact range we are asked for, and we will only do speculative preallocation with delalloc if we are mapping a hole at the EOF page. The iterator will consume the entire range of the folio that is within EOF, and anything beyond the EOF block cannot be accessed. We never need to truncate this post-EOF speculative prealloc away in the context of the iomap_page_mkwrite() iterator because if it remains unused we'll remove it when the last reference to the inode goes away. Hence we don't actually need an .iomap_end() cleanup/error handling path at all for iomap_page_mkwrite() for XFS. This means we can separate the page fault processing from the complexity of the .iomap_end() processing in the buffered write path. This also means that the buffered write path will also be able to take the mapping->invalidate_lock as necessary. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/xfs_file.c | 2 +- fs/xfs/xfs_iomap.c | 9 +++++++++ fs/xfs/xfs_iomap.h | 1 + 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c index e462d39c840e..595a5bcf46b9 100644 --- a/fs/xfs/xfs_file.c +++ b/fs/xfs/xfs_file.c @@ -1325,7 +1325,7 @@ __xfs_filemap_fault( if (write_fault) { xfs_ilock(XFS_I(inode), XFS_MMAPLOCK_SHARED); ret = iomap_page_mkwrite(vmf, - &xfs_buffered_write_iomap_ops); + &xfs_page_mkwrite_iomap_ops); xfs_iunlock(XFS_I(inode), XFS_MMAPLOCK_SHARED); } else { ret = filemap_fault(vmf); diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index 07da03976ec1..5cea069a38b4 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1187,6 +1187,15 @@ const struct iomap_ops xfs_buffered_write_iomap_ops = { .iomap_end = xfs_buffered_write_iomap_end, }; +/* + * iomap_page_mkwrite() will never fail in a way that requires delalloc extents + * that it allocated to be revoked. Hence we do not need an .iomap_end method + * for this operation. + */ +const struct iomap_ops xfs_page_mkwrite_iomap_ops = { + .iomap_begin = xfs_buffered_write_iomap_begin, +}; + static int xfs_read_iomap_begin( struct inode *inode, diff --git a/fs/xfs/xfs_iomap.h b/fs/xfs/xfs_iomap.h index c782e8c0479c..0f62ab633040 100644 --- a/fs/xfs/xfs_iomap.h +++ b/fs/xfs/xfs_iomap.h @@ -47,6 +47,7 @@ xfs_aligned_fsb_count( } extern const struct iomap_ops xfs_buffered_write_iomap_ops; +extern const struct iomap_ops xfs_page_mkwrite_iomap_ops; extern const struct iomap_ops xfs_direct_write_iomap_ops; extern const struct iomap_ops xfs_read_iomap_ops; extern const struct iomap_ops xfs_seek_iomap_ops; From patchwork Fri Apr 26 21:54:49 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645409 Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C976536B17 for ; Fri, 26 Apr 2024 21:55:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168553; cv=none; b=d/MPlgSWXpYQbfZfe3meb3bOmm9fBa+bmqFC2oN9Mhw7T6LLPz3OY8ob8PgetM9QI+PpaAgAbFv0hLGlpkLJ2bzn/IVkwBh7fAXlzSLSkOBO1nAQxFchQGmL7nkL+ObdfNiw0t/5FVvsYX3IQQkG3S9xlUmJffeTmvYHhg2g9i8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168553; c=relaxed/simple; bh=cDNw2h8szMqN7PSm6qK1SYjyz55Y/sBYfDPdI3fCI/A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=m2DHdWVvh9SwEFXhJyuH6djdC4hwBIXZ5NUJY6b0PnUjfy7sAF6Z8YxgpiG65p4rKTzvoj0mun1JDUdiYli47RdBM5Fbvg0InHFb+FC0KUQpBi5Nj8K0JCWwZ0mB4H0wbNXllRRyWxCJfcpafP5xNF084ouoeY7wyNXfpWijyyI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hxV6JGVI; arc=none smtp.client-ip=209.85.214.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hxV6JGVI" Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-1e2b137d666so20634755ad.2 for ; Fri, 26 Apr 2024 14:55:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168551; x=1714773351; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=VtJ3Oh3BhUQkvJodkW44JivQtUo2FHxaKkBN3Bo12AU=; b=hxV6JGVIqaLuutDEglztSIYW/dmvMRsfvvA+1VgDtKOjefIXGUpoT2SBkGG6cd3orz NslA6BqFZdJX03+X0MTHDT157ELV/d653KTbSp3phfQad+SlUcgYSzgurcOIZp0iXWBC p5/g9jbIloUF6hXK/2hBWN1Kf2mUIrISdV/DeBlXMlcP036vEIJEjeyTl2H4TJDbg5rs V9IRPaLNjk9NosERgFHqJMH4INVwsPab5VMg8j2BqgdDp/dXRyAVbOT4UFlQro0adoXm bvOJ2MySVcsLvEXRiCOfgV8LHGPIqGXGe9Ei/6UcWMTADOkVmhoLUQLhAfNW3bQFQQqF Jc1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168551; x=1714773351; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=VtJ3Oh3BhUQkvJodkW44JivQtUo2FHxaKkBN3Bo12AU=; b=poTwvURhG+N+CpxhbSB8zl6E541JDZP6f+mbJv5fIteNe2mnf/W911zfemKIh2cxV2 74VyDTxQFi2w9m5SftVmAA/vcs1TX5J2cTQ94ppIBFoMUWfSXE96i1XfIGrRVSo7eWTQ JyjWtUVitBSGvvPdwRDeXBHZLy+zu/7Ct0Rr2xd/xD2vMEig5bCsHqnZIWyOy8O7ttmf uft/hEaf0lDY87DDwQzk58FfwXzFJLZjbUBjoFm/lr6YnkX1nJ0j8Jrau+NUtwKnnKBY aPLUWN8EOKewjC2cvY747uyoG9mR8MM8Q0T79lw8zuNi64WdqaWpTSmQuB5llj61YJU1 gNPQ== X-Gm-Message-State: AOJu0Yyvk7kRReIqear84pdh+H7zC5Ywd1eb6ZlUEMhLSUK5hJmbUDQh b9Q2tTn1yONGdMWzkgVkYEDlziVfU4HkoXrSNRgfwHrP206W519EFXnhT4AE X-Google-Smtp-Source: AGHT+IFagpbB1I1gaQhTzOdILjDixhdgyQK1FHcJn6mcRTmvKwkJDZKjB286MLLO90DDYBJp5SeXqA== X-Received: by 2002:a17:902:bb87:b0:1e2:688e:597d with SMTP id m7-20020a170902bb8700b001e2688e597dmr3407277pls.21.1714168550967; Fri, 26 Apr 2024 14:55:50 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:50 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , Christoph Hellwig , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 02/24] xfs: punching delalloc extents on write failure is racy Date: Fri, 26 Apr 2024 14:54:49 -0700 Message-ID: <20240426215512.2673806-3-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit 198dd8aedee6a7d2de0dfa739f9a008a938f6848 ] xfs_buffered_write_iomap_end() has a comment about the safety of punching delalloc extents based holding the IOLOCK_EXCL. This comment is wrong, and punching delalloc extents is not race free. When we punch out a delalloc extent after a write failure in xfs_buffered_write_iomap_end(), we punch out the page cache with truncate_pagecache_range() before we punch out the delalloc extents. At this point, we only hold the IOLOCK_EXCL, so there is nothing stopping mmap() write faults racing with this cleanup operation, reinstantiating a folio over the range we are about to punch and hence requiring the delalloc extent to be kept. If this race condition is hit, we can end up with a dirty page in the page cache that has no delalloc extent or space reservation backing it. This leads to bad things happening at writeback time. To avoid this race condition, we need the page cache truncation to be atomic w.r.t. the extent manipulation. We can do this by holding the mapping->invalidate_lock exclusively across this operation - this will prevent new pages from being inserted into the page cache whilst we are removing the pages and the backing extent and space reservation. Taking the mapping->invalidate_lock exclusively in the buffered write IO path is safe - it naturally nests inside the IOLOCK (see truncate and fallocate paths). iomap_zero_range() can be called from under the mapping->invalidate_lock (from the truncate path via either xfs_zero_eof() or xfs_truncate_page(), but iomap_zero_iter() will not instantiate new delalloc pages (because it skips holes) and hence will not ever need to punch out delalloc extents on failure. Fix the locking issue, and clean up the code logic a little to avoid unnecessary work if we didn't allocate the delalloc extent or wrote the entire region we allocated. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/xfs_iomap.c | 41 +++++++++++++++++++++++------------------ 1 file changed, 23 insertions(+), 18 deletions(-) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index 5cea069a38b4..a2e45ea1b0cb 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1147,6 +1147,10 @@ xfs_buffered_write_iomap_end( written = 0; } + /* If we didn't reserve the blocks, we're not allowed to punch them. */ + if (!(iomap->flags & IOMAP_F_NEW)) + return 0; + /* * start_fsb refers to the first unused block after a short write. If * nothing was written, round offset down to point at the first block in @@ -1158,27 +1162,28 @@ xfs_buffered_write_iomap_end( start_fsb = XFS_B_TO_FSB(mp, offset + written); end_fsb = XFS_B_TO_FSB(mp, offset + length); + /* Nothing to do if we've written the entire delalloc extent */ + if (start_fsb >= end_fsb) + return 0; + /* - * Trim delalloc blocks if they were allocated by this write and we - * didn't manage to write the whole range. - * - * We don't need to care about racing delalloc as we hold i_mutex - * across the reserve/allocate/unreserve calls. If there are delalloc - * blocks in the range, they are ours. + * Lock the mapping to avoid races with page faults re-instantiating + * folios and dirtying them via ->page_mkwrite between the page cache + * truncation and the delalloc extent removal. Failing to do this can + * leave dirty pages with no space reservation in the cache. */ - if ((iomap->flags & IOMAP_F_NEW) && start_fsb < end_fsb) { - truncate_pagecache_range(VFS_I(ip), XFS_FSB_TO_B(mp, start_fsb), - XFS_FSB_TO_B(mp, end_fsb) - 1); - - error = xfs_bmap_punch_delalloc_range(ip, start_fsb, - end_fsb - start_fsb); - if (error && !xfs_is_shutdown(mp)) { - xfs_alert(mp, "%s: unable to clean up ino %lld", - __func__, ip->i_ino); - return error; - } + filemap_invalidate_lock(inode->i_mapping); + truncate_pagecache_range(VFS_I(ip), XFS_FSB_TO_B(mp, start_fsb), + XFS_FSB_TO_B(mp, end_fsb) - 1); + + error = xfs_bmap_punch_delalloc_range(ip, start_fsb, + end_fsb - start_fsb); + filemap_invalidate_unlock(inode->i_mapping); + if (error && !xfs_is_shutdown(mp)) { + xfs_alert(mp, "%s: unable to clean up ino %lld", + __func__, ip->i_ino); + return error; } - return 0; } From patchwork Fri Apr 26 21:54:50 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645410 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BDF63374DB for ; Fri, 26 Apr 2024 21:55:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168554; cv=none; b=tUBjzVOzcVYWXqfhJJIYvu5HULLFNzwk1FlQ8fnrE8RdyKasACKt2MhtcOho9lVQTPvInVSP9cqhO+Q+nWbDrNd3nwAjL1II2d08WB0fMfSW5qGq3W4rh/YLNXHL+0HcurUxd3Ec+tLswlbxbhZjhdTkyZVtQv9ZQ5+uKd7OULQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168554; c=relaxed/simple; bh=tez9F/jujdvr48D79dYs09SvYZr4oVrQVffiPgZLFXo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HGysoqSV8IoqBhuO6fztMGZKhI9P7+0byQxf/Fiuoghe/+iRCP3icDzEvVwhBXkNcV3e8CHeUe8ZEK81PpA/dtv5KUmUcUksx1cWYcUXCFJiB32eEEfngzAP5uB1vOlSDMgrygjlj+Kf/QRCPZ6nvdVXAX1ffyIjNyeNSTFPYAI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=W6Mt+V16; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="W6Mt+V16" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-1e651a9f3ffso15748095ad.1 for ; Fri, 26 Apr 2024 14:55:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168552; x=1714773352; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=zNOd3IiNCRIxmQqevajUQqiwaxq0SEglp4nSdU0BE84=; b=W6Mt+V16b+F7k3KrBrA7Ab5eqNd57Ey4WvaYX27LTOzKdN4mCoz6QNf1JkoY6B1DfX daKBguRwQh99oafz3AcDCNV5YWU4Yn5Sz5YqatmQP4tSJC8OSjUnDXEmeAPTueUU03HF HQv6i6CnIm1aH0dE3i6StuYGMvUT3u6m58IPjdcAlPXMMp2ximVQ7NNIEiDlVzPSWzpP IKsa3SRrF/iaJlFR/fN3XWUzVw1bx0HMaSt7hPhJsvMvEaKNEH+70X4ol3poyS4odOdz CS9D3MClAHoT5e4px1UGgtEWiVLvVltxFbs3dwW8PlplZrK4hSZ2rckx8HYOLONEevP3 csaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168552; x=1714773352; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=zNOd3IiNCRIxmQqevajUQqiwaxq0SEglp4nSdU0BE84=; b=BIIY7wu99SOZPZ6oQrFaDJjE4eBMEts2IcmcgKUex8FtwvsE0tWJ5JgskWAaCgUFjp 2wX3ZytCcYgYnSeGYUzGa9wkuAuy4ngW4amoJIV54ec7M5bLnrPdoGBBax4p2DT17Vo+ p4GQfPK/K0Yc5MGk7Mgl/xs6RB0moGuX4P+1TuFhClr8pHoF/LKrTLIC1u3aLKhZ7eOo JoE7V2s+nNcGAl4plpdlnO0G8idT1EFk4Q2faFIix2NPvF+Mq9ZZ89X+v3NUSGp7DQC1 m1cBSh8dqXG0cQYQtnNXOeHhVA8S6F8YTdQfEvLlB7rMo7KKVj3aHIs60QF6npxoN1VJ yfWw== X-Gm-Message-State: AOJu0YwhkjXPCJwQDxH1CD+F7sqafIKM0GqNkhXobGBkIZsvfsGNQTSt Dtwa9LquzHNGUbqzvxnxdhPgd4q+QjYEUZJGTqmE4cw429qM6K6SoQPXQ307 X-Google-Smtp-Source: AGHT+IGWtJF6xdd099UUWchl3r2sEloAd1dq4OMPl08jETkhgXG1oLCeAvj0oNsWugtOpytFxHJEag== X-Received: by 2002:a17:902:f70a:b0:1eb:3d68:fc38 with SMTP id h10-20020a170902f70a00b001eb3d68fc38mr1730406plo.6.1714168551925; Fri, 26 Apr 2024 14:55:51 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:51 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 03/24] xfs: use byte ranges for write cleanup ranges Date: Fri, 26 Apr 2024 14:54:50 -0700 Message-ID: <20240426215512.2673806-4-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit b71f889c18ada210a97aa3eb5e00c0de552234c6 ] xfs_buffered_write_iomap_end() currently converts the byte ranges passed to it to filesystem blocks to pass them to the bmap code to punch out delalloc blocks, but then has to convert filesytem blocks back to byte ranges for page cache truncate. We're about to make the page cache truncate go away and replace it with a page cache walk, so having to convert everything to/from/to filesystem blocks is messy and error-prone. It is much easier to pass around byte ranges and convert to page indexes and/or filesystem blocks only where those units are needed. In preparation for the page cache walk being added, add a helper that converts byte ranges to filesystem blocks and calls xfs_bmap_punch_delalloc_range() and convert xfs_buffered_write_iomap_end() to calculate limits in byte ranges. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/xfs_iomap.c | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index a2e45ea1b0cb..7bb55dbc19d3 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1120,6 +1120,20 @@ xfs_buffered_write_iomap_begin( return error; } +static int +xfs_buffered_write_delalloc_punch( + struct inode *inode, + loff_t start_byte, + loff_t end_byte) +{ + struct xfs_mount *mp = XFS_M(inode->i_sb); + xfs_fileoff_t start_fsb = XFS_B_TO_FSBT(mp, start_byte); + xfs_fileoff_t end_fsb = XFS_B_TO_FSB(mp, end_byte); + + return xfs_bmap_punch_delalloc_range(XFS_I(inode), start_fsb, + end_fsb - start_fsb); +} + static int xfs_buffered_write_iomap_end( struct inode *inode, @@ -1129,10 +1143,9 @@ xfs_buffered_write_iomap_end( unsigned flags, struct iomap *iomap) { - struct xfs_inode *ip = XFS_I(inode); - struct xfs_mount *mp = ip->i_mount; - xfs_fileoff_t start_fsb; - xfs_fileoff_t end_fsb; + struct xfs_mount *mp = XFS_M(inode->i_sb); + loff_t start_byte; + loff_t end_byte; int error = 0; if (iomap->type != IOMAP_DELALLOC) @@ -1157,13 +1170,13 @@ xfs_buffered_write_iomap_end( * the range. */ if (unlikely(!written)) - start_fsb = XFS_B_TO_FSBT(mp, offset); + start_byte = round_down(offset, mp->m_sb.sb_blocksize); else - start_fsb = XFS_B_TO_FSB(mp, offset + written); - end_fsb = XFS_B_TO_FSB(mp, offset + length); + start_byte = round_up(offset + written, mp->m_sb.sb_blocksize); + end_byte = round_up(offset + length, mp->m_sb.sb_blocksize); /* Nothing to do if we've written the entire delalloc extent */ - if (start_fsb >= end_fsb) + if (start_byte >= end_byte) return 0; /* @@ -1173,15 +1186,12 @@ xfs_buffered_write_iomap_end( * leave dirty pages with no space reservation in the cache. */ filemap_invalidate_lock(inode->i_mapping); - truncate_pagecache_range(VFS_I(ip), XFS_FSB_TO_B(mp, start_fsb), - XFS_FSB_TO_B(mp, end_fsb) - 1); - - error = xfs_bmap_punch_delalloc_range(ip, start_fsb, - end_fsb - start_fsb); + truncate_pagecache_range(inode, start_byte, end_byte - 1); + error = xfs_buffered_write_delalloc_punch(inode, start_byte, end_byte); filemap_invalidate_unlock(inode->i_mapping); if (error && !xfs_is_shutdown(mp)) { - xfs_alert(mp, "%s: unable to clean up ino %lld", - __func__, ip->i_ino); + xfs_alert(mp, "%s: unable to clean up ino 0x%llx", + __func__, XFS_I(inode)->i_ino); return error; } return 0; From patchwork Fri Apr 26 21:54:51 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645411 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA99136B17 for ; Fri, 26 Apr 2024 21:55:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168555; cv=none; b=ppU+prvXw4luY4XA6DBVukVtCpWn6xzEUZeD2M1h7jdtfM83nUXUTZ8KpNrnFb7ba/aHNYzJWqGXk95fcPsklE4D52QUFd90uyhii5BA1S20mIfidCTqt/Qt8gMi9W+AqAmQ+FoOQihfeT6W8dCS7tMdJ1z3G4pMpV8kT4UP4+A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168555; c=relaxed/simple; bh=74EzXvfodK2An85RkrYsBhDKHl5q9eYnM26iOYPOG0Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HA9gXuQJY0NNZdp0mEAWLYXyX5mvOddf/ruWXBg6zfbLP7i4dVmyXI0GVzJEsACzNgwSVyWx+L4F2xJjHgPxsArXBwLugPnJ5jCA5siuedTY5cgbbULlCr9vGRFXJljqJraxYNrCWcDHuzfPF0rBXfmK64rlPxe0R31au8Zrskc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ckNFz/uC; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ckNFz/uC" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-1e834159f40so21421105ad.2 for ; Fri, 26 Apr 2024 14:55:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168553; x=1714773353; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=w8EuxZb9dTO7XxZLYwYupZsuh/2kwnjPPgB5uiKl14w=; b=ckNFz/uCbb96An0S9A0thuVncjYZU7Whp6+xbpkKm95AdjGJBgdzXNcLm9TXXJXTGu gSugkJq7wHEaxgTIfY1ckOnwDSaYHg3f6hGGZjKi2Bo0ddDZs5BDzDq+SEwbeTqzSF+s zYQlH7wvJjb1U1UafNOGvQOWbqX4DCRz2ZBcbjtXojE81u96qkCmdPIyVL6aD8M/UZ4a mkl983bilj8ie43hBEunfqEk7qAkdXOLcA3NFK8zIpnV2J5xW+0X5Cu4CG/MbrBtGpNU 4gotPECPAGq62FZHrwYmXzTRZvAn6MOKLOrFaEpCQhjj2uevyhtEQu9QZHBWHhHcLQ9q eTXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168553; x=1714773353; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=w8EuxZb9dTO7XxZLYwYupZsuh/2kwnjPPgB5uiKl14w=; b=sw9bPCMlWE0xz/0XWi7T7Sn+hFClgMUlghnwhVwQVuoyvkWVDQgxxT572l827Dl+5t 1kkXkHHkkLcfhKaNjWzIdnninUruEY8i7eZVhec3XyJCsLVpp0jMD20HWEwu6zLZKuAr wiIyUr/xLE7csCGPTOxfWuznVVngg+qkrmKC8CTT/C0wjvkKZlawPHhb8vD+eDirqOXp 9aLmajyy2qRxrFEjQf/trF/HP8P8U4RZhfg4d46Fq7aQbhI2kXnRpfTlq//HZXZ82nmU 2KiffcTaHbipxzmRKKsZP7Jk34IQ/5GD+O8ACujDxEy1u7akjE3hiGWpwf0sXubixgGR 8qog== X-Gm-Message-State: AOJu0Yz9qZbGUP4tZoJ+GD16f6hxxEV1rnNJP1lYFbAGGUmkI0WfJdls vDSyaWQ8BK335qvKlT2KMqDsnAyDCbRcHUMf1GRKgEErzhK7ZSTv4DTT4IjW X-Google-Smtp-Source: AGHT+IHEPEXaRGpLJhlQeH2FmNE3T+ufVOqYqPUWlw6XBf6eLZDeI87tuRmtmzoockMv2CoMYsojMA== X-Received: by 2002:a17:902:eec1:b0:1e9:1f39:2edb with SMTP id h1-20020a170902eec100b001e91f392edbmr3859575plb.26.1714168552913; Fri, 26 Apr 2024 14:55:52 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:52 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 04/24] xfs,iomap: move delalloc punching to iomap Date: Fri, 26 Apr 2024 14:54:51 -0700 Message-ID: <20240426215512.2673806-5-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit 9c7babf94a0d686b552e53aded8d4703d1b8b92b ] Because that's what Christoph wants for this error handling path only XFS uses. It requires a new iomap export for handling errors over delalloc ranges. This is basically the XFS code as is stands, but even though Christoph wants this as iomap funcitonality, we still have to call it from the filesystem specific ->iomap_end callback, and call into the iomap code with yet another filesystem specific callback to punch the delalloc extent within the defined ranges. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/iomap/buffered-io.c | 60 ++++++++++++++++++++++++++++++++++++++++++ fs/xfs/xfs_iomap.c | 47 ++++++--------------------------- include/linux/iomap.h | 4 +++ 3 files changed, 72 insertions(+), 39 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index a0a4d8de82ca..24be3297822b 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -827,6 +827,66 @@ iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *i, } EXPORT_SYMBOL_GPL(iomap_file_buffered_write); +/* + * When a short write occurs, the filesystem may need to remove reserved space + * that was allocated in ->iomap_begin from it's ->iomap_end method. For + * filesystems that use delayed allocation, we need to punch out delalloc + * extents from the range that are not dirty in the page cache. As the write can + * race with page faults, there can be dirty pages over the delalloc extent + * outside the range of a short write but still within the delalloc extent + * allocated for this iomap. + * + * This function uses [start_byte, end_byte) intervals (i.e. open ended) to + * simplify range iterations, but converts them back to {offset,len} tuples for + * the punch callback. + */ +int iomap_file_buffered_write_punch_delalloc(struct inode *inode, + struct iomap *iomap, loff_t pos, loff_t length, + ssize_t written, + int (*punch)(struct inode *inode, loff_t pos, loff_t length)) +{ + loff_t start_byte; + loff_t end_byte; + int blocksize = i_blocksize(inode); + int error = 0; + + if (iomap->type != IOMAP_DELALLOC) + return 0; + + /* If we didn't reserve the blocks, we're not allowed to punch them. */ + if (!(iomap->flags & IOMAP_F_NEW)) + return 0; + + /* + * start_byte refers to the first unused block after a short write. If + * nothing was written, round offset down to point at the first block in + * the range. + */ + if (unlikely(!written)) + start_byte = round_down(pos, blocksize); + else + start_byte = round_up(pos + written, blocksize); + end_byte = round_up(pos + length, blocksize); + + /* Nothing to do if we've written the entire delalloc extent */ + if (start_byte >= end_byte) + return 0; + + /* + * Lock the mapping to avoid races with page faults re-instantiating + * folios and dirtying them via ->page_mkwrite between the page cache + * truncation and the delalloc extent removal. Failing to do this can + * leave dirty pages with no space reservation in the cache. + */ + filemap_invalidate_lock(inode->i_mapping); + truncate_pagecache_range(inode, start_byte, end_byte - 1); + error = punch(inode, start_byte, end_byte - start_byte); + filemap_invalidate_unlock(inode->i_mapping); + + return error; +} +EXPORT_SYMBOL_GPL(iomap_file_buffered_write_punch_delalloc); + static loff_t iomap_unshare_iter(struct iomap_iter *iter) { struct iomap *iomap = &iter->iomap; diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index 7bb55dbc19d3..ea96e8a34868 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1123,12 +1123,12 @@ xfs_buffered_write_iomap_begin( static int xfs_buffered_write_delalloc_punch( struct inode *inode, - loff_t start_byte, - loff_t end_byte) + loff_t offset, + loff_t length) { struct xfs_mount *mp = XFS_M(inode->i_sb); - xfs_fileoff_t start_fsb = XFS_B_TO_FSBT(mp, start_byte); - xfs_fileoff_t end_fsb = XFS_B_TO_FSB(mp, end_byte); + xfs_fileoff_t start_fsb = XFS_B_TO_FSBT(mp, offset); + xfs_fileoff_t end_fsb = XFS_B_TO_FSB(mp, offset + length); return xfs_bmap_punch_delalloc_range(XFS_I(inode), start_fsb, end_fsb - start_fsb); @@ -1143,13 +1143,9 @@ xfs_buffered_write_iomap_end( unsigned flags, struct iomap *iomap) { - struct xfs_mount *mp = XFS_M(inode->i_sb); - loff_t start_byte; - loff_t end_byte; - int error = 0; - if (iomap->type != IOMAP_DELALLOC) - return 0; + struct xfs_mount *mp = XFS_M(inode->i_sb); + int error; /* * Behave as if the write failed if drop writes is enabled. Set the NEW @@ -1160,35 +1156,8 @@ xfs_buffered_write_iomap_end( written = 0; } - /* If we didn't reserve the blocks, we're not allowed to punch them. */ - if (!(iomap->flags & IOMAP_F_NEW)) - return 0; - - /* - * start_fsb refers to the first unused block after a short write. If - * nothing was written, round offset down to point at the first block in - * the range. - */ - if (unlikely(!written)) - start_byte = round_down(offset, mp->m_sb.sb_blocksize); - else - start_byte = round_up(offset + written, mp->m_sb.sb_blocksize); - end_byte = round_up(offset + length, mp->m_sb.sb_blocksize); - - /* Nothing to do if we've written the entire delalloc extent */ - if (start_byte >= end_byte) - return 0; - - /* - * Lock the mapping to avoid races with page faults re-instantiating - * folios and dirtying them via ->page_mkwrite between the page cache - * truncation and the delalloc extent removal. Failing to do this can - * leave dirty pages with no space reservation in the cache. - */ - filemap_invalidate_lock(inode->i_mapping); - truncate_pagecache_range(inode, start_byte, end_byte - 1); - error = xfs_buffered_write_delalloc_punch(inode, start_byte, end_byte); - filemap_invalidate_unlock(inode->i_mapping); + error = iomap_file_buffered_write_punch_delalloc(inode, iomap, offset, + length, written, &xfs_buffered_write_delalloc_punch); if (error && !xfs_is_shutdown(mp)) { xfs_alert(mp, "%s: unable to clean up ino 0x%llx", __func__, XFS_I(inode)->i_ino); diff --git a/include/linux/iomap.h b/include/linux/iomap.h index 238a03087e17..0698c4b8ce0e 100644 --- a/include/linux/iomap.h +++ b/include/linux/iomap.h @@ -226,6 +226,10 @@ static inline const struct iomap *iomap_iter_srcmap(const struct iomap_iter *i) ssize_t iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *from, const struct iomap_ops *ops); +int iomap_file_buffered_write_punch_delalloc(struct inode *inode, + struct iomap *iomap, loff_t pos, loff_t length, ssize_t written, + int (*punch)(struct inode *inode, loff_t pos, loff_t length)); + int iomap_read_folio(struct folio *folio, const struct iomap_ops *ops); void iomap_readahead(struct readahead_control *, const struct iomap_ops *ops); bool iomap_is_partially_uptodate(struct folio *, size_t from, size_t count); From patchwork Fri Apr 26 21:54:52 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645412 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1BD0F37707 for ; Fri, 26 Apr 2024 21:55:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168556; cv=none; b=BAu4xPv/GhgLv2Q9VO2ytA+v6rdnXbx/qvL99CseFB/lgzFnukgq1IpyYcyU0IinGtqh3tNPjN9oOf56F+lzC/T5kRXj8Zz3HQ9UlZS9eKO9DvxegiSgu/iDqhxaZeTTJrbTS3HeonxZjEUxdNb73VgPItVPX43L0GJvg0H+DL0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168556; c=relaxed/simple; bh=LSuztRn2Mh5e54GmtyO1Njz2lcIATbt/aEwr/6iyBO4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RViKY9UKsyZ+hc4oAZJ4FyWCPaLJJ+17TdaeVep2Fw6PP+4b3KhXRUTJMnSD8D/GndpbDKeyHSSS5Ql0eolpcAN++ZdQ4K7OWk29Usbglz8yqznOUzG6nLNsqJCAUlKWLwZn+S4tXytchwKXz2JhP/Ek+4ZLR3ARh/Bsivsepqs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ky27Jj06; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ky27Jj06" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-1e5c7d087e1so24210265ad.0 for ; Fri, 26 Apr 2024 14:55:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168554; x=1714773354; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=oIX8Dc9Jk7ZUW90SF+BIyxKwrUycFVc4zJBTZhEK4OI=; b=ky27Jj06aIlGIBVu5bbYPi9DsRbyTVQwJYoyPqj8WfRGuz37SOIJLzOeF85nLbQ059 xw8OpCqEyQ0VFDSGbH8fzIAkZhBkjijZ/xJ4rgj5qe2HsbkQN2yONFD0aTaqzGgnZ5lQ RXx+jlKOo1jrg7qE3C7/UNXoHRfMBg4DlXDWEzcTQC6s7EE/d8Uz9RlKaehDbTfIfcIw wph4fWScCS5nEiFdOgovEsqGjxK2VwqUfJ6bvGmm9sKbF2CaD5yTbxnYvBoDBe/0VMPE K5EKUEp7YKNqLuYvMjlnopJrsjJ2NxWLXUTY3nlCTKx4iS24sSxTlSh+yXGwHm2CSzCd Vv/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168554; x=1714773354; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=oIX8Dc9Jk7ZUW90SF+BIyxKwrUycFVc4zJBTZhEK4OI=; b=jj7i3XOWoHIKrfxEd9DR4qGJt7d+JC7HLywpNtB2W3XPXgHbVQKrfxuiC5JEgZFHSK z4+CS9LI9kPL0VFTYKNGVmBQIOpENnaycSY159xF9I/0vDhdsnCSKVh9Zu8391pSexhh XjY87qT3xIhuEho2FZQ9zKpgw4PtKgKgF9PXakgNma8zOcytG8SwTYOlG2+osmE1IMB4 6bFJiiLljyIYVk6l0zA22lk/a0ftcAB9/0ySoln42Ux64Qa7M+FfQMX8ba5NqN51eJuw QMnlJEZiFSjhVWEJTD1WkILmUjDxVwIJfDYDS7VEYq+/ctfPhF5+Dr/qNtJzgg8wJJxV bngg== X-Gm-Message-State: AOJu0Yy6Y/5ujJ9Yq9bOtRk7uPlEKSVWi94DGF6hzeiuBm5jLVSXXOxJ VXAjrYvML0RVPtP/9bzE43cfXPoTWefJTfpXHACKYtb/lts6kr11NOEw0ZwX X-Google-Smtp-Source: AGHT+IHoxbmGri2fC3Mg5p+VqmPNDZhXeaGFSV9goLMVcoyjSgfAwL6j4sDtpEYpgnbQ+Uk2oHCIXQ== X-Received: by 2002:a17:902:ec8a:b0:1e4:203d:ab80 with SMTP id x10-20020a170902ec8a00b001e4203dab80mr4681972plg.57.1714168554038; Fri, 26 Apr 2024 14:55:54 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:53 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 05/24] iomap: buffered write failure should not truncate the page cache Date: Fri, 26 Apr 2024 14:54:52 -0700 Message-ID: <20240426215512.2673806-6-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 ] iomap_file_buffered_write_punch_delalloc() currently invalidates the page cache over the unused range of the delalloc extent that was allocated. While the write allocated the delalloc extent, it does not own it exclusively as the write does not hold any locks that prevent either writeback or mmap page faults from changing the state of either the page cache or the extent state backing this range. Whilst xfs_bmap_punch_delalloc_range() already handles races in extent conversion - it will only punch out delalloc extents and it ignores any other type of extent - the page cache truncate does not discriminate between data written by this write or some other task. As a result, truncating the page cache can result in data corruption if the write races with mmap modifications to the file over the same range. generic/346 exercises this workload, and if we randomly fail writes (as will happen when iomap gets stale iomap detection later in the patchset), it will randomly corrupt the file data because it removes data written by mmap() in the same page as the write() that failed. Hence we do not want to punch out the page cache over the range of the extent we failed to write to - what we actually need to do is detect the ranges that have dirty data in cache over them and *not punch them out*. To do this, we have to walk the page cache over the range of the delalloc extent we want to remove. This is made complex by the fact we have to handle partially up-to-date folios correctly and this can happen even when the FSB size == PAGE_SIZE because we now support multi-page folios in the page cache. Because we are only interested in discovering the edges of data ranges in the page cache (i.e. hole-data boundaries) we can make use of mapping_seek_hole_data() to find those transitions in the page cache. As we hold the invalidate_lock, we know that the boundaries are not going to change while we walk the range. This interface is also byte-based and is sub-page block aware, so we can find the data ranges in the cache based on byte offsets rather than page, folio or fs block sized chunks. This greatly simplifies the logic of finding dirty cached ranges in the page cache. Once we've identified a range that contains cached data, we can then iterate the range folio by folio. This allows us to determine if the data is dirty and hence perform the correct delalloc extent punching operations. The seek interface we use to iterate data ranges will give us sub-folio start/end granularity, so we may end up looking up the same folio multiple times as the seek interface iterates across each discontiguous data region in the folio. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/iomap/buffered-io.c | 195 +++++++++++++++++++++++++++++++++++++---- 1 file changed, 180 insertions(+), 15 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index 24be3297822b..60bd16f1a23f 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -827,6 +827,165 @@ iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *i, } EXPORT_SYMBOL_GPL(iomap_file_buffered_write); +/* + * Scan the data range passed to us for dirty page cache folios. If we find a + * dirty folio, punch out the preceeding range and update the offset from which + * the next punch will start from. + * + * We can punch out storage reservations under clean pages because they either + * contain data that has been written back - in which case the delalloc punch + * over that range is a no-op - or they have been read faults in which case they + * contain zeroes and we can remove the delalloc backing range and any new + * writes to those pages will do the normal hole filling operation... + * + * This makes the logic simple: we only need to keep the delalloc extents only + * over the dirty ranges of the page cache. + * + * This function uses [start_byte, end_byte) intervals (i.e. open ended) to + * simplify range iterations. + */ +static int iomap_write_delalloc_scan(struct inode *inode, + loff_t *punch_start_byte, loff_t start_byte, loff_t end_byte, + int (*punch)(struct inode *inode, loff_t offset, loff_t length)) +{ + while (start_byte < end_byte) { + struct folio *folio; + + /* grab locked page */ + folio = filemap_lock_folio(inode->i_mapping, + start_byte >> PAGE_SHIFT); + if (!folio) { + start_byte = ALIGN_DOWN(start_byte, PAGE_SIZE) + + PAGE_SIZE; + continue; + } + + /* if dirty, punch up to offset */ + if (folio_test_dirty(folio)) { + if (start_byte > *punch_start_byte) { + int error; + + error = punch(inode, *punch_start_byte, + start_byte - *punch_start_byte); + if (error) { + folio_unlock(folio); + folio_put(folio); + return error; + } + } + + /* + * Make sure the next punch start is correctly bound to + * the end of this data range, not the end of the folio. + */ + *punch_start_byte = min_t(loff_t, end_byte, + folio_next_index(folio) << PAGE_SHIFT); + } + + /* move offset to start of next folio in range */ + start_byte = folio_next_index(folio) << PAGE_SHIFT; + folio_unlock(folio); + folio_put(folio); + } + return 0; +} + +/* + * Punch out all the delalloc blocks in the range given except for those that + * have dirty data still pending in the page cache - those are going to be + * written and so must still retain the delalloc backing for writeback. + * + * As we are scanning the page cache for data, we don't need to reimplement the + * wheel - mapping_seek_hole_data() does exactly what we need to identify the + * start and end of data ranges correctly even for sub-folio block sizes. This + * byte range based iteration is especially convenient because it means we + * don't have to care about variable size folios, nor where the start or end of + * the data range lies within a folio, if they lie within the same folio or even + * if there are multiple discontiguous data ranges within the folio. + * + * It should be noted that mapping_seek_hole_data() is not aware of EOF, and so + * can return data ranges that exist in the cache beyond EOF. e.g. a page fault + * spanning EOF will initialise the post-EOF data to zeroes and mark it up to + * date. A write page fault can then mark it dirty. If we then fail a write() + * beyond EOF into that up to date cached range, we allocate a delalloc block + * beyond EOF and then have to punch it out. Because the range is up to date, + * mapping_seek_hole_data() will return it, and we will skip the punch because + * the folio is dirty. THis is incorrect - we always need to punch out delalloc + * beyond EOF in this case as writeback will never write back and covert that + * delalloc block beyond EOF. Hence we limit the cached data scan range to EOF, + * resulting in always punching out the range from the EOF to the end of the + * range the iomap spans. + * + * Intervals are of the form [start_byte, end_byte) (i.e. open ended) because it + * matches the intervals returned by mapping_seek_hole_data(). i.e. SEEK_DATA + * returns the start of a data range (start_byte), and SEEK_HOLE(start_byte) + * returns the end of the data range (data_end). Using closed intervals would + * require sprinkling this code with magic "+ 1" and "- 1" arithmetic and expose + * the code to subtle off-by-one bugs.... + */ +static int iomap_write_delalloc_release(struct inode *inode, + loff_t start_byte, loff_t end_byte, + int (*punch)(struct inode *inode, loff_t pos, loff_t length)) +{ + loff_t punch_start_byte = start_byte; + loff_t scan_end_byte = min(i_size_read(inode), end_byte); + int error = 0; + + /* + * Lock the mapping to avoid races with page faults re-instantiating + * folios and dirtying them via ->page_mkwrite whilst we walk the + * cache and perform delalloc extent removal. Failing to do this can + * leave dirty pages with no space reservation in the cache. + */ + filemap_invalidate_lock(inode->i_mapping); + while (start_byte < scan_end_byte) { + loff_t data_end; + + start_byte = mapping_seek_hole_data(inode->i_mapping, + start_byte, scan_end_byte, SEEK_DATA); + /* + * If there is no more data to scan, all that is left is to + * punch out the remaining range. + */ + if (start_byte == -ENXIO || start_byte == scan_end_byte) + break; + if (start_byte < 0) { + error = start_byte; + goto out_unlock; + } + WARN_ON_ONCE(start_byte < punch_start_byte); + WARN_ON_ONCE(start_byte > scan_end_byte); + + /* + * We find the end of this contiguous cached data range by + * seeking from start_byte to the beginning of the next hole. + */ + data_end = mapping_seek_hole_data(inode->i_mapping, start_byte, + scan_end_byte, SEEK_HOLE); + if (data_end < 0) { + error = data_end; + goto out_unlock; + } + WARN_ON_ONCE(data_end <= start_byte); + WARN_ON_ONCE(data_end > scan_end_byte); + + error = iomap_write_delalloc_scan(inode, &punch_start_byte, + start_byte, data_end, punch); + if (error) + goto out_unlock; + + /* The next data search starts at the end of this one. */ + start_byte = data_end; + } + + if (punch_start_byte < end_byte) + error = punch(inode, punch_start_byte, + end_byte - punch_start_byte); +out_unlock: + filemap_invalidate_unlock(inode->i_mapping); + return error; +} + /* * When a short write occurs, the filesystem may need to remove reserved space * that was allocated in ->iomap_begin from it's ->iomap_end method. For @@ -837,8 +996,25 @@ EXPORT_SYMBOL_GPL(iomap_file_buffered_write); * allocated for this iomap. * * This function uses [start_byte, end_byte) intervals (i.e. open ended) to - * simplify range iterations, but converts them back to {offset,len} tuples for - * the punch callback. + * simplify range iterations. + * + * The punch() callback *must* only punch delalloc extents in the range passed + * to it. It must skip over all other types of extents in the range and leave + * them completely unchanged. It must do this punch atomically with respect to + * other extent modifications. + * + * The punch() callback may be called with a folio locked to prevent writeback + * extent allocation racing at the edge of the range we are currently punching. + * The locked folio may or may not cover the range being punched, so it is not + * safe for the punch() callback to lock folios itself. + * + * Lock order is: + * + * inode->i_rwsem (shared or exclusive) + * inode->i_mapping->invalidate_lock (exclusive) + * folio_lock() + * ->punch + * internal filesystem allocation lock */ int iomap_file_buffered_write_punch_delalloc(struct inode *inode, struct iomap *iomap, loff_t pos, loff_t length, @@ -848,7 +1024,6 @@ int iomap_file_buffered_write_punch_delalloc(struct inode *inode, loff_t start_byte; loff_t end_byte; int blocksize = i_blocksize(inode); - int error = 0; if (iomap->type != IOMAP_DELALLOC) return 0; @@ -872,18 +1047,8 @@ int iomap_file_buffered_write_punch_delalloc(struct inode *inode, if (start_byte >= end_byte) return 0; - /* - * Lock the mapping to avoid races with page faults re-instantiating - * folios and dirtying them via ->page_mkwrite between the page cache - * truncation and the delalloc extent removal. Failing to do this can - * leave dirty pages with no space reservation in the cache. - */ - filemap_invalidate_lock(inode->i_mapping); - truncate_pagecache_range(inode, start_byte, end_byte - 1); - error = punch(inode, start_byte, end_byte - start_byte); - filemap_invalidate_unlock(inode->i_mapping); - - return error; + return iomap_write_delalloc_release(inode, start_byte, end_byte, + punch); } EXPORT_SYMBOL_GPL(iomap_file_buffered_write_punch_delalloc); From patchwork Fri Apr 26 21:54:53 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645413 Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0380C36B17 for ; Fri, 26 Apr 2024 21:55:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168557; cv=none; b=MCZtMTTJXr6BZ0bLlTmWubnQw2tuhfxAHTk0FrIBwi/6ii/oUH6y2RyHt0VdBxR8WEaG7GfHyTRiUkJbSqWFOFFTtfSKrkspk+cMlN55u4uU+XN87vXdLO0hnNxvm2eYtixgPMT1rulaWlMV/z7WOqK5vJYKoJxqylW6g/Z1HEg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168557; c=relaxed/simple; bh=u8JO4w3l37IF4urxqp5LT3dnN+M5KBdbmobx25GKsjU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=u2jHs1cKGqe1eewR8h56z3xjhELgt9cuTlC2acH3A84bHPNqjdyYEwJWhBrF1RyeqbBsiaX9fjFLK3Nwz+l8a8kSxUJwtswqk8psguwCMCwpXPqOwRf34csOXiuAqSl+07/lJUW6OtA22aiJs1mnuxazEtqNyqBzanWq2W5coS0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XMVHtvYR; arc=none smtp.client-ip=209.85.214.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XMVHtvYR" Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-1eb0e08bfd2so7686965ad.1 for ; Fri, 26 Apr 2024 14:55:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168555; x=1714773355; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=bvCc5WYGZ4cnKLb9iJ7KaL3Fdjd6Lh5J040eZYLmRN4=; b=XMVHtvYRFtGQ3yrrnIlPRk/thLRasq6KcHfwsGOjHQLG1foqrBnyc1Xd5Vi4hnaAej 1j8o82nXmEzFqcY2Dl+H+lb3rDTsWIiR7WGQcCAYN8qWN1iO8lWcpQnuOUQTJ39iH5Yd OL1ikRuGredC+IDAiMF7IQiLapKdv47XZRtCWvSCQgHg322T4Hc2jPgrw+tNS9R913db XJu/dQJwpyXvLS+dTfRLnnfdxYlNKBaiosmK7Pg4iU0C/5B1I+DWmYlqvjROybIh6ZjJ wCQht3kybOeMgdpEd3Ra455XT9GEZ0aJRxti6Sp3YMb340psvyz7ENNKAScwVb2mG75y BOCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168555; x=1714773355; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=bvCc5WYGZ4cnKLb9iJ7KaL3Fdjd6Lh5J040eZYLmRN4=; b=MbbXLW736k9+cpjtRow+ZhMZaFDabsdfX+NYdcEQ7pbkGSxziuJVHyHqn5m5Y9QeoA q7ZpOm5hFnEVvinBhQOZWDdzFit3h5+mYcXDt+22atB5k4LKUu3yyqtXh8qYJ26Ubeha mUZizLD5kjIAynuVbqsjdeR0IZvdodvySskBbHaRS22udFbOFcffSKd8mcOFp1g/gjn5 eGzm6MmPD85WQ11hCNX8dEECI/hr7D9Zw2KpKS31YgLmA0OtQJ/eXUyg1S4wIMGWqN+O XqqAO4dXsft7DeEoPo+47GW9Z7xDvIg9bw2d2ivOMpQBNFPmxthQQGkWFf6SsUPWQt0y KApA== X-Gm-Message-State: AOJu0YzCvsMOFDwRqGk66JMceiEFf9axha8gx/zcI/e/9WH3x3YclxOE fF7hq80uaXNo5x/yd4Sp1dvv8SiR7/PrO4SVptMlo7q6keLeLvZXOyopCo9x X-Google-Smtp-Source: AGHT+IGbZvB2Tpi/amPAy1Wu9sb9UWlyZujB1LrH8sa1gnX1sbJMnAmUBVxSp3lLFuCmPrrA3WDqsA== X-Received: by 2002:a17:902:ba89:b0:1e5:3554:d9db with SMTP id k9-20020a170902ba8900b001e53554d9dbmr3294673pls.64.1714168555028; Fri, 26 Apr 2024 14:55:55 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:54 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 06/24] xfs: xfs_bmap_punch_delalloc_range() should take a byte range Date: Fri, 26 Apr 2024 14:54:53 -0700 Message-ID: <20240426215512.2673806-7-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit 7348b322332d8602a4133f0b861334ea021b134a ] All the callers of xfs_bmap_punch_delalloc_range() jump through hoops to convert a byte range to filesystem blocks before calling xfs_bmap_punch_delalloc_range(). Instead, pass the byte range to xfs_bmap_punch_delalloc_range() and have it do the conversion to filesystem blocks internally. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/xfs_aops.c | 16 ++++++---------- fs/xfs/xfs_bmap_util.c | 10 ++++++---- fs/xfs/xfs_bmap_util.h | 2 +- fs/xfs/xfs_iomap.c | 8 ++------ 4 files changed, 15 insertions(+), 21 deletions(-) diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index 5d1a995b15f8..6aadc5815068 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -114,9 +114,8 @@ xfs_end_ioend( if (unlikely(error)) { if (ioend->io_flags & IOMAP_F_SHARED) { xfs_reflink_cancel_cow_range(ip, offset, size, true); - xfs_bmap_punch_delalloc_range(ip, - XFS_B_TO_FSBT(mp, offset), - XFS_B_TO_FSB(mp, size)); + xfs_bmap_punch_delalloc_range(ip, offset, + offset + size); } goto done; } @@ -455,12 +454,8 @@ xfs_discard_folio( struct folio *folio, loff_t pos) { - struct inode *inode = folio->mapping->host; - struct xfs_inode *ip = XFS_I(inode); + struct xfs_inode *ip = XFS_I(folio->mapping->host); struct xfs_mount *mp = ip->i_mount; - size_t offset = offset_in_folio(folio, pos); - xfs_fileoff_t start_fsb = XFS_B_TO_FSBT(mp, pos); - xfs_fileoff_t pageoff_fsb = XFS_B_TO_FSBT(mp, offset); int error; if (xfs_is_shutdown(mp)) @@ -470,8 +465,9 @@ xfs_discard_folio( "page discard on page "PTR_FMT", inode 0x%llx, pos %llu.", folio, ip->i_ino, pos); - error = xfs_bmap_punch_delalloc_range(ip, start_fsb, - i_blocks_per_folio(inode, folio) - pageoff_fsb); + error = xfs_bmap_punch_delalloc_range(ip, pos, + round_up(pos, folio_size(folio))); + if (error && !xfs_is_shutdown(mp)) xfs_alert(mp, "page discard unable to remove delalloc mapping."); } diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c index 04d0c2bff67c..867645b74d88 100644 --- a/fs/xfs/xfs_bmap_util.c +++ b/fs/xfs/xfs_bmap_util.c @@ -590,11 +590,13 @@ xfs_getbmap( int xfs_bmap_punch_delalloc_range( struct xfs_inode *ip, - xfs_fileoff_t start_fsb, - xfs_fileoff_t length) + xfs_off_t start_byte, + xfs_off_t end_byte) { + struct xfs_mount *mp = ip->i_mount; struct xfs_ifork *ifp = &ip->i_df; - xfs_fileoff_t end_fsb = start_fsb + length; + xfs_fileoff_t start_fsb = XFS_B_TO_FSBT(mp, start_byte); + xfs_fileoff_t end_fsb = XFS_B_TO_FSB(mp, end_byte); struct xfs_bmbt_irec got, del; struct xfs_iext_cursor icur; int error = 0; @@ -607,7 +609,7 @@ xfs_bmap_punch_delalloc_range( while (got.br_startoff + got.br_blockcount > start_fsb) { del = got; - xfs_trim_extent(&del, start_fsb, length); + xfs_trim_extent(&del, start_fsb, end_fsb - start_fsb); /* * A delete can push the cursor forward. Step back to the diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h index 24b37d211f1d..6888078f5c31 100644 --- a/fs/xfs/xfs_bmap_util.h +++ b/fs/xfs/xfs_bmap_util.h @@ -31,7 +31,7 @@ xfs_bmap_rtalloc(struct xfs_bmalloca *ap) #endif /* CONFIG_XFS_RT */ int xfs_bmap_punch_delalloc_range(struct xfs_inode *ip, - xfs_fileoff_t start_fsb, xfs_fileoff_t length); + xfs_off_t start_byte, xfs_off_t end_byte); struct kgetbmap { __s64 bmv_offset; /* file offset of segment in blocks */ diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index ea96e8a34868..09676ff6940e 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1126,12 +1126,8 @@ xfs_buffered_write_delalloc_punch( loff_t offset, loff_t length) { - struct xfs_mount *mp = XFS_M(inode->i_sb); - xfs_fileoff_t start_fsb = XFS_B_TO_FSBT(mp, offset); - xfs_fileoff_t end_fsb = XFS_B_TO_FSB(mp, offset + length); - - return xfs_bmap_punch_delalloc_range(XFS_I(inode), start_fsb, - end_fsb - start_fsb); + return xfs_bmap_punch_delalloc_range(XFS_I(inode), offset, + offset + length); } static int From patchwork Fri Apr 26 21:54:54 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645414 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E155328680 for ; Fri, 26 Apr 2024 21:55:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168558; cv=none; b=rlCDtvKwIRZzcOGv1++g+YP72KjPWCSuyWCJqVEwsGOcfSRESadVjqac2CgcG50vRmOeGxPVW2KJmPPhwOQhDILH3EQiggG3eaklNGVdtyeXRqV6kqtWOzzGCXagotSAph7Rbl3+YW23uYToc4OOJW4Ie0L47k3JBpO0OiACW0E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168558; c=relaxed/simple; bh=F0E50P6aQ/FYXU74/TCZGyhqL0wEPgqEFkbJxDXMuKs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=anGZLlCe6/OWIquBq9g5u6smJZO22KBLqlXVvKIUBsG7GhwAn+Qw915+ucnmiaI0Ylx8MlpGTOdb2VdTQf8YETK//eT5xAHDxFv3Y8YYusPe1z4zzZmnNFE+MYe5PHWYtaYHTPmv83dWMXISMXzDtQcVHMWdibRkLky+OlH1TOw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eQnRn4H7; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eQnRn4H7" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-1e3ca546d40so22425615ad.3 for ; Fri, 26 Apr 2024 14:55:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168556; x=1714773356; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=kwHJvdeAp+eOsu+b1czCiGR7KJCorKy8EbW4bSHZx5o=; b=eQnRn4H7sXDH6O/QFYdVBWg399/RZY6eWzJ3GcWJ0M58j/D/k5YaZaH+X3JYnz/kkO So0c0fpAE+wLEeieHTKZ8nzrbehqHEeu9e56xs7iAkx34Vr+6nycPPBoGlDod18byxCV ZIFtY53PIF8u8CMpE8+ffurhGN45kXQKHlgZwpvosmAAEM5rdtWJ6mAFEC8NqIxtp+Ro PLR1kXSq8R1oXHUlcyMe7D6YLKpF3QKhwBL2GqEsB5OXjQBGG9kC9+JmOkayZ/vpYJKW wxZbH9jkbwhpvWXf7fAwJqx6I1hTZgJ/o1Dq/Dy0+vLdK6JJWlJUP2uIqATI1Uh7rktm BnCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168556; x=1714773356; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=kwHJvdeAp+eOsu+b1czCiGR7KJCorKy8EbW4bSHZx5o=; b=LSBZ7BogGFMJwGcQLtX9E0m+X3GHnsM2fdLix/Hh+J6q+krZhBG/py1eXRGVtuLJ9+ 5p0siv1mWDTP/mYUlGxISBI7+dFrz1GTlxPMGjfFwJ2AcP+XrBvLVEYEbYQpXYgzNQCT LlarnyX1r2xK3XGi3D6d7O/QcNNZLqbZoaWnqt0ZyA+KfGDLZtVwFJ9XVoD2dxfPOeWf +rFyG12NVDjs0ZKBzQik60poSEvhXE8ZKxUYvTFaC2RsFnFge8O/VfSqDte5ZlU9jNqg ttBl5r/F/dOu5Szz3+0Nm8rraEFPL+GIJMhKtGhmPkH/sHRsk7Cxlsa+1qhPhs/k/th9 /XfQ== X-Gm-Message-State: AOJu0Yym4kZLvGJNnUYsYDL16TVKLwtW8v8eDDtL4mZvzkaYfIf1DLsI SbtMe55ohGNHQKe5u2qfvz+7P32BZ1TvOaTUxv5IP06m+KfZ4U8B+SA0yJpM X-Google-Smtp-Source: AGHT+IFNfS/HvjuVGFD9a1Eoodvd3deNleSbNJ/2a16GemrCt6r1tBbIBVr+RiZDjosjOTmxXu3L7g== X-Received: by 2002:a17:902:6e02:b0:1dd:c288:899f with SMTP id u2-20020a1709026e0200b001ddc288899fmr3699027plk.18.1714168556022; Fri, 26 Apr 2024 14:55:56 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:55 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , Christoph Hellwig , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 07/24] iomap: write iomap validity checks Date: Fri, 26 Apr 2024 14:54:54 -0700 Message-ID: <20240426215512.2673806-8-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit d7b64041164ca177170191d2ad775da074ab2926 ] A recent multithreaded write data corruption has been uncovered in the iomap write code. The core of the problem is partial folio writes can be flushed to disk while a new racing write can map it and fill the rest of the page: writeback new write allocate blocks blocks are unwritten submit IO ..... map blocks iomap indicates UNWRITTEN range loop { lock folio copyin data ..... IO completes runs unwritten extent conv blocks are marked written get next folio } Now add memory pressure such that memory reclaim evicts the partially written folio that has already been written to disk. When the new write finally gets to the last partial page of the new write, it does not find it in cache, so it instantiates a new page, sees the iomap is unwritten, and zeros the part of the page that it does not have data from. This overwrites the data on disk that was originally written. The full description of the corruption mechanism can be found here: https://lore.kernel.org/linux-xfs/20220817093627.GZ3600936@dread.disaster.area/ To solve this problem, we need to check whether the iomap is still valid after we lock each folio during the write. We have to do it after we lock the page so that we don't end up with state changes occurring while we wait for the folio to be locked. Hence we need a mechanism to be able to check that the cached iomap is still valid (similar to what we already do in buffered writeback), and we need a way for ->begin_write to back out and tell the high level iomap iterator that we need to remap the remaining write range. The iomap needs to grow some storage for the validity cookie that the filesystem provides to travel with the iomap. XFS, in particular, also needs to know some more information about what the iomap maps (attribute extents rather than file data extents) to for the validity cookie to cover all the types of iomaps we might need to validate. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/iomap/buffered-io.c | 29 +++++++++++++++++++++++++++- fs/iomap/iter.c | 19 ++++++++++++++++++- include/linux/iomap.h | 43 ++++++++++++++++++++++++++++++++++-------- 3 files changed, 81 insertions(+), 10 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index 60bd16f1a23f..dac1a5c110c0 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -579,7 +579,7 @@ static int iomap_write_begin_inline(const struct iomap_iter *iter, return iomap_read_inline_data(iter, folio); } -static int iomap_write_begin(const struct iomap_iter *iter, loff_t pos, +static int iomap_write_begin(struct iomap_iter *iter, loff_t pos, size_t len, struct folio **foliop) { const struct iomap_page_ops *page_ops = iter->iomap.page_ops; @@ -613,6 +613,27 @@ static int iomap_write_begin(const struct iomap_iter *iter, loff_t pos, status = (iter->flags & IOMAP_NOWAIT) ? -EAGAIN : -ENOMEM; goto out_no_page; } + + /* + * Now we have a locked folio, before we do anything with it we need to + * check that the iomap we have cached is not stale. The inode extent + * mapping can change due to concurrent IO in flight (e.g. + * IOMAP_UNWRITTEN state can change and memory reclaim could have + * reclaimed a previously partially written page at this index after IO + * completion before this write reaches this file offset) and hence we + * could do the wrong thing here (zero a page range incorrectly or fail + * to zero) and corrupt data. + */ + if (page_ops && page_ops->iomap_valid) { + bool iomap_valid = page_ops->iomap_valid(iter->inode, + &iter->iomap); + if (!iomap_valid) { + iter->iomap.flags |= IOMAP_F_STALE; + status = 0; + goto out_unlock; + } + } + if (pos + len > folio_pos(folio) + folio_size(folio)) len = folio_pos(folio) + folio_size(folio) - pos; @@ -768,6 +789,8 @@ static loff_t iomap_write_iter(struct iomap_iter *iter, struct iov_iter *i) status = iomap_write_begin(iter, pos, bytes, &folio); if (unlikely(status)) break; + if (iter->iomap.flags & IOMAP_F_STALE) + break; page = folio_file_page(folio, pos >> PAGE_SHIFT); if (mapping_writably_mapped(mapping)) @@ -1076,6 +1099,8 @@ static loff_t iomap_unshare_iter(struct iomap_iter *iter) status = iomap_write_begin(iter, pos, bytes, &folio); if (unlikely(status)) return status; + if (iter->iomap.flags & IOMAP_F_STALE) + break; status = iomap_write_end(iter, pos, bytes, bytes, folio); if (WARN_ON_ONCE(status == 0)) @@ -1131,6 +1156,8 @@ static loff_t iomap_zero_iter(struct iomap_iter *iter, bool *did_zero) status = iomap_write_begin(iter, pos, bytes, &folio); if (status) return status; + if (iter->iomap.flags & IOMAP_F_STALE) + break; offset = offset_in_folio(folio, pos); if (bytes > folio_size(folio) - offset) diff --git a/fs/iomap/iter.c b/fs/iomap/iter.c index a1c7592d2ade..79a0614eaab7 100644 --- a/fs/iomap/iter.c +++ b/fs/iomap/iter.c @@ -7,12 +7,28 @@ #include #include "trace.h" +/* + * Advance to the next range we need to map. + * + * If the iomap is marked IOMAP_F_STALE, it means the existing map was not fully + * processed - it was aborted because the extent the iomap spanned may have been + * changed during the operation. In this case, the iteration behaviour is to + * remap the unprocessed range of the iter, and that means we may need to remap + * even when we've made no progress (i.e. iter->processed = 0). Hence the + * "finished iterating" case needs to distinguish between + * (processed = 0) meaning we are done and (processed = 0 && stale) meaning we + * need to remap the entire remaining range. + */ static inline int iomap_iter_advance(struct iomap_iter *iter) { + bool stale = iter->iomap.flags & IOMAP_F_STALE; + /* handle the previous iteration (if any) */ if (iter->iomap.length) { - if (iter->processed <= 0) + if (iter->processed < 0) return iter->processed; + if (!iter->processed && !stale) + return 0; if (WARN_ON_ONCE(iter->processed > iomap_length(iter))) return -EIO; iter->pos += iter->processed; @@ -33,6 +49,7 @@ static inline void iomap_iter_done(struct iomap_iter *iter) WARN_ON_ONCE(iter->iomap.offset > iter->pos); WARN_ON_ONCE(iter->iomap.length == 0); WARN_ON_ONCE(iter->iomap.offset + iter->iomap.length <= iter->pos); + WARN_ON_ONCE(iter->iomap.flags & IOMAP_F_STALE); trace_iomap_iter_dstmap(iter->inode, &iter->iomap); if (iter->srcmap.type != IOMAP_HOLE) diff --git a/include/linux/iomap.h b/include/linux/iomap.h index 0698c4b8ce0e..0983dfc9a203 100644 --- a/include/linux/iomap.h +++ b/include/linux/iomap.h @@ -49,26 +49,35 @@ struct vm_fault; * * IOMAP_F_BUFFER_HEAD indicates that the file system requires the use of * buffer heads for this mapping. + * + * IOMAP_F_XATTR indicates that the iomap is for an extended attribute extent + * rather than a file data extent. */ -#define IOMAP_F_NEW 0x01 -#define IOMAP_F_DIRTY 0x02 -#define IOMAP_F_SHARED 0x04 -#define IOMAP_F_MERGED 0x08 -#define IOMAP_F_BUFFER_HEAD 0x10 -#define IOMAP_F_ZONE_APPEND 0x20 +#define IOMAP_F_NEW (1U << 0) +#define IOMAP_F_DIRTY (1U << 1) +#define IOMAP_F_SHARED (1U << 2) +#define IOMAP_F_MERGED (1U << 3) +#define IOMAP_F_BUFFER_HEAD (1U << 4) +#define IOMAP_F_ZONE_APPEND (1U << 5) +#define IOMAP_F_XATTR (1U << 6) /* * Flags set by the core iomap code during operations: * * IOMAP_F_SIZE_CHANGED indicates to the iomap_end method that the file size * has changed as the result of this write operation. + * + * IOMAP_F_STALE indicates that the iomap is not valid any longer and the file + * range it covers needs to be remapped by the high level before the operation + * can proceed. */ -#define IOMAP_F_SIZE_CHANGED 0x100 +#define IOMAP_F_SIZE_CHANGED (1U << 8) +#define IOMAP_F_STALE (1U << 9) /* * Flags from 0x1000 up are for file system specific usage: */ -#define IOMAP_F_PRIVATE 0x1000 +#define IOMAP_F_PRIVATE (1U << 12) /* @@ -89,6 +98,7 @@ struct iomap { void *inline_data; void *private; /* filesystem private */ const struct iomap_page_ops *page_ops; + u64 validity_cookie; /* used with .iomap_valid() */ }; static inline sector_t iomap_sector(const struct iomap *iomap, loff_t pos) @@ -128,6 +138,23 @@ struct iomap_page_ops { int (*page_prepare)(struct inode *inode, loff_t pos, unsigned len); void (*page_done)(struct inode *inode, loff_t pos, unsigned copied, struct page *page); + + /* + * Check that the cached iomap still maps correctly to the filesystem's + * internal extent map. FS internal extent maps can change while iomap + * is iterating a cached iomap, so this hook allows iomap to detect that + * the iomap needs to be refreshed during a long running write + * operation. + * + * The filesystem can store internal state (e.g. a sequence number) in + * iomap->validity_cookie when the iomap is first mapped to be able to + * detect changes between mapping time and whenever .iomap_valid() is + * called. + * + * This is called with the folio over the specified file position held + * locked by the iomap code. + */ + bool (*iomap_valid)(struct inode *inode, const struct iomap *iomap); }; /* From patchwork Fri Apr 26 21:54:55 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645415 Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF6FF36B17 for ; Fri, 26 Apr 2024 21:55:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168559; cv=none; b=KOEfW/kcKxIbWSXS1nP4ZPKo4we8wxXDF3sMqHP9OJPp8A0lhH7GbEOix5h6XeCwMLDc2RN9nNh+W9RWNLOMyc21p8euiR2Bq0QyodwEW3LRXfj4brieYWHfN3FtNpwfauXDU0T/zrQP4ggK9OChMDGw33bH32+N+WCrfHcGMEs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168559; c=relaxed/simple; bh=L/HqJtliPZaT/TnE+ZwHMu0evLpJg9PYEExiNOzdA8k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JIIk9TPqMqqK/tKZKDLddDKKmERCfDJmLT7eM/89yXbR4Q4pO54rp1gPAkGkPujN0J86TRG5F8qs242RYe4/eNG3ytH0H0yo/jbO9I398Kt/2JxH3KpKMzSiTNUiedeiOUwY5Uz1rWujtXnsGJDVekHCEwtd4GJ4694x+qZnGfQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MqffD1Bf; arc=none smtp.client-ip=209.85.210.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MqffD1Bf" Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-6ed04c91c46so2608641b3a.0 for ; Fri, 26 Apr 2024 14:55:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168557; x=1714773357; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=9TsNN/ojDVP5RiZ9+b7xeUa4H2PtvV8G9jKOagEhw2g=; b=MqffD1Bfs8c/YAKtDD88l4jXkVyGefn2JouV2mrv4si1y6a6yjVcJjmruWwMHRSK9v lVxzXNiv3/wm1NwVoHi/XMoDqIoujiuYir1kNLpnoBdMy8Vi5BeAyzI+C20RajHIbVan 2X6OcXdru3WPn61bO9Nr+/aXtgHUWQfQiWTyO85lAAdobnRtZwcclwwAQD3554ITU1Xq /dxlWrR17FJrvYclVhTC5ngYlivkAUpbnh5i/tZmjNcpjHdICOlEDVDduf6OFOeCdend IK6hpdGOgpyPzuNT6/x1hnbpm+T7WCwunDKdDPLUGFZ74zC1pIlS7kQtKfxqyP9y5Mo3 mB0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168557; x=1714773357; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=9TsNN/ojDVP5RiZ9+b7xeUa4H2PtvV8G9jKOagEhw2g=; b=ofNQ2GWDuxTr/5ifJe2Q0DqiNmO8xwC+AdMoAjT8IEy6uvzN1xWS4x4JRJ+9moHz6b jg22ejVnnafQvS0F93+SyYS8EqLSzS9tQdVCAVaSB/b8gxxp0U0h23go59+ipQfxgBDN 60u2eozI0cRpfgZXg1j2Vi6C0Jb4Vh25mWx+TOGaSeiIfiLEGe7HgGL6IkqZuNdPFDX+ MSfHUfrotde33PUN+mB79QHEfxAbSY3ww8aBpXp6X6w4Z+7Xk5Ym1f9lNdZ7RDrWNPwt cmwpvSWXFQB7enLQd2QOXNSBEuSLf89IVjyZs/GncbgkpWaCE0bsmI3HvaupPsKrAxI7 BwOw== X-Gm-Message-State: AOJu0YxDfjQXH4kOkpPZCG1PHU1/axZN7nvu7/2v52WA3GWIoNDbUDE0 upwYobXbibivROf7vPJCKW5zaPSimP3xcdnyxQwjzBac0kYaqyM8IJWqyvLM X-Google-Smtp-Source: AGHT+IEArIvIxMlH5Nq1QzRSgHN35N68tQwfG2NpJaUAE8nwKjoXQWMt1quBd11mdxRbhmpC4Nb4gw== X-Received: by 2002:a17:902:b60f:b0:1e4:3320:dbed with SMTP id b15-20020a170902b60f00b001e43320dbedmr3986566pls.52.1714168557077; Fri, 26 Apr 2024 14:55:57 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:56 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 08/24] xfs: use iomap_valid method to detect stale cached iomaps Date: Fri, 26 Apr 2024 14:54:55 -0700 Message-ID: <20240426215512.2673806-9-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit 304a68b9c63bbfc1f6e159d68e8892fc54a06067 ] Now that iomap supports a mechanism to validate cached iomaps for buffered write operations, hook it up to the XFS buffered write ops so that we can avoid data corruptions that result from stale cached iomaps. See: https://lore.kernel.org/linux-xfs/20220817093627.GZ3600936@dread.disaster.area/ or the ->iomap_valid() introduction commit for exact details of the corruption vector. The validity cookie we store in the iomap is based on the type of iomap we return. It is expected that the iomap->flags we set in xfs_bmbt_to_iomap() is not perturbed by the iomap core and are returned to us in the iomap passed via the .iomap_valid() callback. This ensures that the validity cookie is always checking the correct inode fork sequence numbers to detect potential changes that affect the extent cached by the iomap. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/libxfs/xfs_bmap.c | 6 ++- fs/xfs/xfs_aops.c | 2 +- fs/xfs/xfs_iomap.c | 95 +++++++++++++++++++++++++++++++--------- fs/xfs/xfs_iomap.h | 5 ++- fs/xfs/xfs_pnfs.c | 6 ++- 5 files changed, 87 insertions(+), 27 deletions(-) diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c index 49d0d4ea63fc..56b9b7db38bb 100644 --- a/fs/xfs/libxfs/xfs_bmap.c +++ b/fs/xfs/libxfs/xfs_bmap.c @@ -4551,7 +4551,8 @@ xfs_bmapi_convert_delalloc( * the extent. Just return the real extent at this offset. */ if (!isnullstartblock(bma.got.br_startblock)) { - xfs_bmbt_to_iomap(ip, iomap, &bma.got, 0, flags); + xfs_bmbt_to_iomap(ip, iomap, &bma.got, 0, flags, + xfs_iomap_inode_sequence(ip, flags)); *seq = READ_ONCE(ifp->if_seq); goto out_trans_cancel; } @@ -4599,7 +4600,8 @@ xfs_bmapi_convert_delalloc( XFS_STATS_INC(mp, xs_xstrat_quick); ASSERT(!isnullstartblock(bma.got.br_startblock)); - xfs_bmbt_to_iomap(ip, iomap, &bma.got, 0, flags); + xfs_bmbt_to_iomap(ip, iomap, &bma.got, 0, flags, + xfs_iomap_inode_sequence(ip, flags)); *seq = READ_ONCE(ifp->if_seq); if (whichfork == XFS_COW_FORK) diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index 6aadc5815068..a22d90af40c8 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -372,7 +372,7 @@ xfs_map_blocks( isnullstartblock(imap.br_startblock)) goto allocate_blocks; - xfs_bmbt_to_iomap(ip, &wpc->iomap, &imap, 0, 0); + xfs_bmbt_to_iomap(ip, &wpc->iomap, &imap, 0, 0, XFS_WPC(wpc)->data_seq); trace_xfs_map_blocks_found(ip, offset, count, whichfork, &imap); return 0; allocate_blocks: diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index 09676ff6940e..26ca3cc1a048 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -48,13 +48,45 @@ xfs_alert_fsblock_zero( return -EFSCORRUPTED; } +u64 +xfs_iomap_inode_sequence( + struct xfs_inode *ip, + u16 iomap_flags) +{ + u64 cookie = 0; + + if (iomap_flags & IOMAP_F_XATTR) + return READ_ONCE(ip->i_af.if_seq); + if ((iomap_flags & IOMAP_F_SHARED) && ip->i_cowfp) + cookie = (u64)READ_ONCE(ip->i_cowfp->if_seq) << 32; + return cookie | READ_ONCE(ip->i_df.if_seq); +} + +/* + * Check that the iomap passed to us is still valid for the given offset and + * length. + */ +static bool +xfs_iomap_valid( + struct inode *inode, + const struct iomap *iomap) +{ + return iomap->validity_cookie == + xfs_iomap_inode_sequence(XFS_I(inode), iomap->flags); +} + +const struct iomap_page_ops xfs_iomap_page_ops = { + .iomap_valid = xfs_iomap_valid, +}; + int xfs_bmbt_to_iomap( struct xfs_inode *ip, struct iomap *iomap, struct xfs_bmbt_irec *imap, unsigned int mapping_flags, - u16 iomap_flags) + u16 iomap_flags, + u64 sequence_cookie) { struct xfs_mount *mp = ip->i_mount; struct xfs_buftarg *target = xfs_inode_buftarg(ip); @@ -91,6 +123,9 @@ xfs_bmbt_to_iomap( if (xfs_ipincount(ip) && (ip->i_itemp->ili_fsync_fields & ~XFS_ILOG_TIMESTAMP)) iomap->flags |= IOMAP_F_DIRTY; + + iomap->validity_cookie = sequence_cookie; + iomap->page_ops = &xfs_iomap_page_ops; return 0; } @@ -195,7 +230,8 @@ xfs_iomap_write_direct( xfs_fileoff_t offset_fsb, xfs_fileoff_t count_fsb, unsigned int flags, - struct xfs_bmbt_irec *imap) + struct xfs_bmbt_irec *imap, + u64 *seq) { struct xfs_mount *mp = ip->i_mount; struct xfs_trans *tp; @@ -285,6 +321,7 @@ xfs_iomap_write_direct( error = xfs_alert_fsblock_zero(ip, imap); out_unlock: + *seq = xfs_iomap_inode_sequence(ip, 0); xfs_iunlock(ip, XFS_ILOCK_EXCL); return error; @@ -743,6 +780,7 @@ xfs_direct_write_iomap_begin( bool shared = false; u16 iomap_flags = 0; unsigned int lockmode = XFS_ILOCK_SHARED; + u64 seq; ASSERT(flags & (IOMAP_WRITE | IOMAP_ZERO)); @@ -811,9 +849,10 @@ xfs_direct_write_iomap_begin( goto out_unlock; } + seq = xfs_iomap_inode_sequence(ip, iomap_flags); xfs_iunlock(ip, lockmode); trace_xfs_iomap_found(ip, offset, length, XFS_DATA_FORK, &imap); - return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, iomap_flags); + return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, iomap_flags, seq); allocate_blocks: error = -EAGAIN; @@ -839,24 +878,26 @@ xfs_direct_write_iomap_begin( xfs_iunlock(ip, lockmode); error = xfs_iomap_write_direct(ip, offset_fsb, end_fsb - offset_fsb, - flags, &imap); + flags, &imap, &seq); if (error) return error; trace_xfs_iomap_alloc(ip, offset, length, XFS_DATA_FORK, &imap); return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, - iomap_flags | IOMAP_F_NEW); + iomap_flags | IOMAP_F_NEW, seq); out_found_cow: - xfs_iunlock(ip, lockmode); length = XFS_FSB_TO_B(mp, cmap.br_startoff + cmap.br_blockcount); trace_xfs_iomap_found(ip, offset, length - offset, XFS_COW_FORK, &cmap); if (imap.br_startblock != HOLESTARTBLOCK) { - error = xfs_bmbt_to_iomap(ip, srcmap, &imap, flags, 0); + seq = xfs_iomap_inode_sequence(ip, 0); + error = xfs_bmbt_to_iomap(ip, srcmap, &imap, flags, 0, seq); if (error) - return error; + goto out_unlock; } - return xfs_bmbt_to_iomap(ip, iomap, &cmap, flags, IOMAP_F_SHARED); + seq = xfs_iomap_inode_sequence(ip, IOMAP_F_SHARED); + xfs_iunlock(ip, lockmode); + return xfs_bmbt_to_iomap(ip, iomap, &cmap, flags, IOMAP_F_SHARED, seq); out_unlock: if (lockmode) @@ -915,6 +956,7 @@ xfs_buffered_write_iomap_begin( int allocfork = XFS_DATA_FORK; int error = 0; unsigned int lockmode = XFS_ILOCK_EXCL; + u64 seq; if (xfs_is_shutdown(mp)) return -EIO; @@ -1094,26 +1136,31 @@ xfs_buffered_write_iomap_begin( * Flag newly allocated delalloc blocks with IOMAP_F_NEW so we punch * them out if the write happens to fail. */ + seq = xfs_iomap_inode_sequence(ip, IOMAP_F_NEW); xfs_iunlock(ip, XFS_ILOCK_EXCL); trace_xfs_iomap_alloc(ip, offset, count, allocfork, &imap); - return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, IOMAP_F_NEW); + return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, IOMAP_F_NEW, seq); found_imap: + seq = xfs_iomap_inode_sequence(ip, 0); xfs_iunlock(ip, XFS_ILOCK_EXCL); - return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, 0); + return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, 0, seq); found_cow: - xfs_iunlock(ip, XFS_ILOCK_EXCL); + seq = xfs_iomap_inode_sequence(ip, 0); if (imap.br_startoff <= offset_fsb) { - error = xfs_bmbt_to_iomap(ip, srcmap, &imap, flags, 0); + error = xfs_bmbt_to_iomap(ip, srcmap, &imap, flags, 0, seq); if (error) - return error; + goto out_unlock; + seq = xfs_iomap_inode_sequence(ip, IOMAP_F_SHARED); + xfs_iunlock(ip, XFS_ILOCK_EXCL); return xfs_bmbt_to_iomap(ip, iomap, &cmap, flags, - IOMAP_F_SHARED); + IOMAP_F_SHARED, seq); } xfs_trim_extent(&cmap, offset_fsb, imap.br_startoff - offset_fsb); - return xfs_bmbt_to_iomap(ip, iomap, &cmap, flags, 0); + xfs_iunlock(ip, XFS_ILOCK_EXCL); + return xfs_bmbt_to_iomap(ip, iomap, &cmap, flags, 0, seq); out_unlock: xfs_iunlock(ip, XFS_ILOCK_EXCL); @@ -1193,6 +1240,7 @@ xfs_read_iomap_begin( int nimaps = 1, error = 0; bool shared = false; unsigned int lockmode = XFS_ILOCK_SHARED; + u64 seq; ASSERT(!(flags & (IOMAP_WRITE | IOMAP_ZERO))); @@ -1206,13 +1254,14 @@ xfs_read_iomap_begin( &nimaps, 0); if (!error && (flags & IOMAP_REPORT)) error = xfs_reflink_trim_around_shared(ip, &imap, &shared); + seq = xfs_iomap_inode_sequence(ip, shared ? IOMAP_F_SHARED : 0); xfs_iunlock(ip, lockmode); if (error) return error; trace_xfs_iomap_found(ip, offset, length, XFS_DATA_FORK, &imap); return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, - shared ? IOMAP_F_SHARED : 0); + shared ? IOMAP_F_SHARED : 0, seq); } const struct iomap_ops xfs_read_iomap_ops = { @@ -1237,6 +1286,7 @@ xfs_seek_iomap_begin( struct xfs_bmbt_irec imap, cmap; int error = 0; unsigned lockmode; + u64 seq; if (xfs_is_shutdown(mp)) return -EIO; @@ -1271,8 +1321,9 @@ xfs_seek_iomap_begin( if (data_fsb < cow_fsb + cmap.br_blockcount) end_fsb = min(end_fsb, data_fsb); xfs_trim_extent(&cmap, offset_fsb, end_fsb); + seq = xfs_iomap_inode_sequence(ip, IOMAP_F_SHARED); error = xfs_bmbt_to_iomap(ip, iomap, &cmap, flags, - IOMAP_F_SHARED); + IOMAP_F_SHARED, seq); /* * This is a COW extent, so we must probe the page cache * because there could be dirty page cache being backed @@ -1293,8 +1344,9 @@ xfs_seek_iomap_begin( imap.br_startblock = HOLESTARTBLOCK; imap.br_state = XFS_EXT_NORM; done: + seq = xfs_iomap_inode_sequence(ip, 0); xfs_trim_extent(&imap, offset_fsb, end_fsb); - error = xfs_bmbt_to_iomap(ip, iomap, &imap, flags, 0); + error = xfs_bmbt_to_iomap(ip, iomap, &imap, flags, 0, seq); out_unlock: xfs_iunlock(ip, lockmode); return error; @@ -1320,6 +1372,7 @@ xfs_xattr_iomap_begin( struct xfs_bmbt_irec imap; int nimaps = 1, error = 0; unsigned lockmode; + int seq; if (xfs_is_shutdown(mp)) return -EIO; @@ -1336,12 +1389,14 @@ xfs_xattr_iomap_begin( error = xfs_bmapi_read(ip, offset_fsb, end_fsb - offset_fsb, &imap, &nimaps, XFS_BMAPI_ATTRFORK); out_unlock: + + seq = xfs_iomap_inode_sequence(ip, IOMAP_F_XATTR); xfs_iunlock(ip, lockmode); if (error) return error; ASSERT(nimaps); - return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, 0); + return xfs_bmbt_to_iomap(ip, iomap, &imap, flags, IOMAP_F_XATTR, seq); } const struct iomap_ops xfs_xattr_iomap_ops = { diff --git a/fs/xfs/xfs_iomap.h b/fs/xfs/xfs_iomap.h index 0f62ab633040..4da13440bae9 100644 --- a/fs/xfs/xfs_iomap.h +++ b/fs/xfs/xfs_iomap.h @@ -13,14 +13,15 @@ struct xfs_bmbt_irec; int xfs_iomap_write_direct(struct xfs_inode *ip, xfs_fileoff_t offset_fsb, xfs_fileoff_t count_fsb, unsigned int flags, - struct xfs_bmbt_irec *imap); + struct xfs_bmbt_irec *imap, u64 *sequence); int xfs_iomap_write_unwritten(struct xfs_inode *, xfs_off_t, xfs_off_t, bool); xfs_fileoff_t xfs_iomap_eof_align_last_fsb(struct xfs_inode *ip, xfs_fileoff_t end_fsb); +u64 xfs_iomap_inode_sequence(struct xfs_inode *ip, u16 iomap_flags); int xfs_bmbt_to_iomap(struct xfs_inode *ip, struct iomap *iomap, struct xfs_bmbt_irec *imap, unsigned int mapping_flags, - u16 iomap_flags); + u16 iomap_flags, u64 sequence_cookie); int xfs_zero_range(struct xfs_inode *ip, loff_t pos, loff_t len, bool *did_zero); diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c index 37a24f0f7cd4..38d23f0e703a 100644 --- a/fs/xfs/xfs_pnfs.c +++ b/fs/xfs/xfs_pnfs.c @@ -125,6 +125,7 @@ xfs_fs_map_blocks( int nimaps = 1; uint lock_flags; int error = 0; + u64 seq; if (xfs_is_shutdown(mp)) return -EIO; @@ -176,6 +177,7 @@ xfs_fs_map_blocks( lock_flags = xfs_ilock_data_map_shared(ip); error = xfs_bmapi_read(ip, offset_fsb, end_fsb - offset_fsb, &imap, &nimaps, bmapi_flags); + seq = xfs_iomap_inode_sequence(ip, 0); ASSERT(!nimaps || imap.br_startblock != DELAYSTARTBLOCK); @@ -189,7 +191,7 @@ xfs_fs_map_blocks( xfs_iunlock(ip, lock_flags); error = xfs_iomap_write_direct(ip, offset_fsb, - end_fsb - offset_fsb, 0, &imap); + end_fsb - offset_fsb, 0, &imap, &seq); if (error) goto out_unlock; @@ -209,7 +211,7 @@ xfs_fs_map_blocks( } xfs_iunlock(ip, XFS_IOLOCK_EXCL); - error = xfs_bmbt_to_iomap(ip, iomap, &imap, 0, 0); + error = xfs_bmbt_to_iomap(ip, iomap, &imap, 0, 0, seq); *device_generation = mp->m_generation; return error; out_unlock: From patchwork Fri Apr 26 21:54:56 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645416 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF48A381D4 for ; Fri, 26 Apr 2024 21:55:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168560; cv=none; b=i58rZxYzzUQFPwB2FIOPPVjZt3P91Tn5N2talvOUOchdNUkGghe99g27Boi39/b6HctKJ4Vo72ugqtMFDv0pfKALFe020NllHRhdztoNKxWF8fZ/OmCzWaTTQ9GazhixRZiLxC+1Gvb4CpIlOJaQbDrynKVo3TaFa+tYp906Rp8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168560; c=relaxed/simple; bh=Pag27RLhf/fjxN21PPXWOIJptCkeXfw1WB25E4eUGVw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JNVD+UA8iruRpsejojDJqo3NCGwJNCN5vyBEnJur53akT3al1LzdB1SCSDuA6wXP2ZkZIICWg9b7drfetWXOYZAEKDFv4msEILCYYiIaIoMythoY5f/lo8rWG+Qzx8jJOhXBzb6f122CCUeVkDoAR1lc62AIsxZ9FqEx9brPk/Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BelQUQHS; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BelQUQHS" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-1e5c7d087e1so24210575ad.0 for ; Fri, 26 Apr 2024 14:55:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168558; x=1714773358; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=QbhwHamMQBJ/nG+atYxUtLApxqX1upN+Bbg6lNHMq3U=; b=BelQUQHS3Iq+jCsE7a9jVtqS7ODxNQc7lFPhflhLH0IJRDUbdV3quAXmN+SCodzoOj I96roiSO4bEbRNzuVHMOfIV1sSCfYcEmNo9FtpK+A02fY6943k5wn1A+Z3I8a5kN1+IW f2gTzb+QKWyIrWV/Ri3b1VJRQDRVvetFb2NoJwK+BK41VLKAgVqucWZVVMi1I1WTzfjo jqf2yaNOGacga2X9YW5facRgQhjtRyNDXksGnu/pSA8DjGnDuHfMj1dN76BG/A8xX2sV VT8i27oW4Nvrv1RcgoaOe8hmjJUrTVndgsoNtQfTl/eae9/hQAkDTGQ59g/lWr3I9gBr 3IBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168558; x=1714773358; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=QbhwHamMQBJ/nG+atYxUtLApxqX1upN+Bbg6lNHMq3U=; b=SgfNepm0MWLvpK+aa1jY8ct5Z0Qa92bf0c6rT5+LXyDjlwbhDS3cHtfpMdnNJeFnLq 1kTeuf6bHx53liiJQSqDAK56m6VNjlaRLeHJvHG3Vsjjqp5xjmjmXDgvFiD4GH7A4oR3 BYImv4z5eyiprvrgYvoPZG/+rDTem6UMRr9rxhOIvQ0lAgZ5AXj7PY+JbHM7C0Nk//Pf Q7vzDNJcmvW197otARXCvWytuHNwb+2Qz+LnpUI841tadslzAymMJhSYsYDhONF+Sm70 s6tlDkfDIBxZ+l5mrjdn8aF+GuvsNXqwm31jmAikD8mU/Li+lxkR3c/WUcJ/y+woIsrf eS+A== X-Gm-Message-State: AOJu0Yz6c+IlElZpAXrUxsqWIyFp7iKnwnXRhUhWwt4qn5sY2SPte9eB tbXM0ZU7N6Lw25x0fLbTWjmAqEOAH2qjNhrcZzH0HTOic0C1u7ry8xk/K7Xe X-Google-Smtp-Source: AGHT+IGW1m/gIlfFSSKllfT3anokjdDEZ+6TJV4bchyTb8XEOZjnxbeNr+IVUsm4NZSm8YhIT+wl3g== X-Received: by 2002:a17:903:1249:b0:1e4:b1eb:7dee with SMTP id u9-20020a170903124900b001e4b1eb7deemr4873974plh.47.1714168558005; Fri, 26 Apr 2024 14:55:58 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:57 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 09/24] xfs: drop write error injection is unfixable, remove it Date: Fri, 26 Apr 2024 14:54:56 -0700 Message-ID: <20240426215512.2673806-10-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit 6e8af15ccdc4e138a5b529c1901a0013e1dcaa09 ] With the changes to scan the page cache for dirty data to avoid data corruptions from partial write cleanup racing with other page cache operations, the drop writes error injection no longer works the same way it used to and causes xfs/196 to fail. This is because xfs/196 writes to the file and populates the page cache before it turns on the error injection and starts failing -overwrites-. The result is that the original drop-writes code failed writes only -after- overwriting the data in the cache, followed by invalidates the cached data, then punching out the delalloc extent from under that data. On the surface, this looks fine. The problem is that page cache invalidation *doesn't guarantee that it removes anything from the page cache* and it doesn't change the dirty state of the folio. When block size == page size and we do page aligned IO (as xfs/196 does) everything happens to align perfectly and page cache invalidation removes the single page folios that span the written data. Hence the followup delalloc punch pass does not find cached data over that range and it can punch the extent out. IOWs, xfs/196 "works" for block size == page size with the new code. I say "works", because it actually only works for the case where IO is page aligned, and no data was read from disk before writes occur. Because the moment we actually read data first, the readahead code allocates multipage folios and suddenly the invalidate code goes back to zeroing subfolio ranges without changing dirty state. Hence, with multipage folios in play, block size == page size is functionally identical to block size < page size behaviour, and drop-writes is manifestly broken w.r.t to this case. Invalidation of a subfolio range doesn't result in the folio being removed from the cache, just the range gets zeroed. Hence after we've sequentially walked over a folio that we've dirtied (via write data) and then invalidated, we end up with a dirty folio full of zeroed data. And because the new code skips punching ranges that have dirty folios covering them, we end up leaving the delalloc range intact after failing all the writes. Hence failed writes now end up writing zeroes to disk in the cases where invalidation zeroes folios rather than removing them from cache. This is a fundamental change of behaviour that is needed to avoid the data corruption vectors that exist in the old write fail path, and it renders the drop-writes injection non-functional and unworkable as it stands. As it is, I think the error injection is also now unnecessary, as partial writes that need delalloc extent are going to be a lot more common with stale iomap detection in place. Hence this patch removes the drop-writes error injection completely. xfs/196 can remain for testing kernels that don't have this data corruption fix, but those that do will report: xfs/196 3s ... [not run] XFS error injection drop_writes unknown on this kernel. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/libxfs/xfs_errortag.h | 12 +++++------- fs/xfs/xfs_error.c | 27 ++++++++++++++++++++------- fs/xfs/xfs_iomap.c | 9 --------- 3 files changed, 25 insertions(+), 23 deletions(-) diff --git a/fs/xfs/libxfs/xfs_errortag.h b/fs/xfs/libxfs/xfs_errortag.h index 5362908164b0..580ccbd5aadc 100644 --- a/fs/xfs/libxfs/xfs_errortag.h +++ b/fs/xfs/libxfs/xfs_errortag.h @@ -40,13 +40,12 @@ #define XFS_ERRTAG_REFCOUNT_FINISH_ONE 25 #define XFS_ERRTAG_BMAP_FINISH_ONE 26 #define XFS_ERRTAG_AG_RESV_CRITICAL 27 + /* - * DEBUG mode instrumentation to test and/or trigger delayed allocation - * block killing in the event of failed writes. When enabled, all - * buffered writes are silenty dropped and handled as if they failed. - * All delalloc blocks in the range of the write (including pre-existing - * delalloc blocks!) are tossed as part of the write failure error - * handling sequence. + * Drop-writes support removed because write error handling cannot trash + * pre-existing delalloc extents in any useful way anymore. We retain the + * definition so that we can reject it as an invalid value in + * xfs_errortag_valid(). */ #define XFS_ERRTAG_DROP_WRITES 28 #define XFS_ERRTAG_LOG_BAD_CRC 29 @@ -95,7 +94,6 @@ #define XFS_RANDOM_REFCOUNT_FINISH_ONE 1 #define XFS_RANDOM_BMAP_FINISH_ONE 1 #define XFS_RANDOM_AG_RESV_CRITICAL 4 -#define XFS_RANDOM_DROP_WRITES 1 #define XFS_RANDOM_LOG_BAD_CRC 1 #define XFS_RANDOM_LOG_ITEM_PIN 1 #define XFS_RANDOM_BUF_LRU_REF 2 diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c index c6b2aabd6f18..dea3c0649d2f 100644 --- a/fs/xfs/xfs_error.c +++ b/fs/xfs/xfs_error.c @@ -46,7 +46,7 @@ static unsigned int xfs_errortag_random_default[] = { XFS_RANDOM_REFCOUNT_FINISH_ONE, XFS_RANDOM_BMAP_FINISH_ONE, XFS_RANDOM_AG_RESV_CRITICAL, - XFS_RANDOM_DROP_WRITES, + 0, /* XFS_RANDOM_DROP_WRITES has been removed */ XFS_RANDOM_LOG_BAD_CRC, XFS_RANDOM_LOG_ITEM_PIN, XFS_RANDOM_BUF_LRU_REF, @@ -162,7 +162,6 @@ XFS_ERRORTAG_ATTR_RW(refcount_continue_update, XFS_ERRTAG_REFCOUNT_CONTINUE_UPDA XFS_ERRORTAG_ATTR_RW(refcount_finish_one, XFS_ERRTAG_REFCOUNT_FINISH_ONE); XFS_ERRORTAG_ATTR_RW(bmap_finish_one, XFS_ERRTAG_BMAP_FINISH_ONE); XFS_ERRORTAG_ATTR_RW(ag_resv_critical, XFS_ERRTAG_AG_RESV_CRITICAL); -XFS_ERRORTAG_ATTR_RW(drop_writes, XFS_ERRTAG_DROP_WRITES); XFS_ERRORTAG_ATTR_RW(log_bad_crc, XFS_ERRTAG_LOG_BAD_CRC); XFS_ERRORTAG_ATTR_RW(log_item_pin, XFS_ERRTAG_LOG_ITEM_PIN); XFS_ERRORTAG_ATTR_RW(buf_lru_ref, XFS_ERRTAG_BUF_LRU_REF); @@ -206,7 +205,6 @@ static struct attribute *xfs_errortag_attrs[] = { XFS_ERRORTAG_ATTR_LIST(refcount_finish_one), XFS_ERRORTAG_ATTR_LIST(bmap_finish_one), XFS_ERRORTAG_ATTR_LIST(ag_resv_critical), - XFS_ERRORTAG_ATTR_LIST(drop_writes), XFS_ERRORTAG_ATTR_LIST(log_bad_crc), XFS_ERRORTAG_ATTR_LIST(log_item_pin), XFS_ERRORTAG_ATTR_LIST(buf_lru_ref), @@ -256,6 +254,19 @@ xfs_errortag_del( kmem_free(mp->m_errortag); } +static bool +xfs_errortag_valid( + unsigned int error_tag) +{ + if (error_tag >= XFS_ERRTAG_MAX) + return false; + + /* Error out removed injection types */ + if (error_tag == XFS_ERRTAG_DROP_WRITES) + return false; + return true; +} + bool xfs_errortag_test( struct xfs_mount *mp, @@ -277,7 +288,9 @@ xfs_errortag_test( if (!mp->m_errortag) return false; - ASSERT(error_tag < XFS_ERRTAG_MAX); + if (!xfs_errortag_valid(error_tag)) + return false; + randfactor = mp->m_errortag[error_tag]; if (!randfactor || prandom_u32_max(randfactor)) return false; @@ -293,7 +306,7 @@ xfs_errortag_get( struct xfs_mount *mp, unsigned int error_tag) { - if (error_tag >= XFS_ERRTAG_MAX) + if (!xfs_errortag_valid(error_tag)) return -EINVAL; return mp->m_errortag[error_tag]; @@ -305,7 +318,7 @@ xfs_errortag_set( unsigned int error_tag, unsigned int tag_value) { - if (error_tag >= XFS_ERRTAG_MAX) + if (!xfs_errortag_valid(error_tag)) return -EINVAL; mp->m_errortag[error_tag] = tag_value; @@ -319,7 +332,7 @@ xfs_errortag_add( { BUILD_BUG_ON(ARRAY_SIZE(xfs_errortag_random_default) != XFS_ERRTAG_MAX); - if (error_tag >= XFS_ERRTAG_MAX) + if (!xfs_errortag_valid(error_tag)) return -EINVAL; return xfs_errortag_set(mp, error_tag, diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index 26ca3cc1a048..1bdd7afc1010 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1190,15 +1190,6 @@ xfs_buffered_write_iomap_end( struct xfs_mount *mp = XFS_M(inode->i_sb); int error; - /* - * Behave as if the write failed if drop writes is enabled. Set the NEW - * flag to force delalloc cleanup. - */ - if (XFS_TEST_ERROR(false, mp, XFS_ERRTAG_DROP_WRITES)) { - iomap->flags |= IOMAP_F_NEW; - written = 0; - } - error = iomap_file_buffered_write_punch_delalloc(inode, iomap, offset, length, written, &xfs_buffered_write_delalloc_punch); if (error && !xfs_is_shutdown(mp)) { From patchwork Fri Apr 26 21:54:57 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645417 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B0DA738396 for ; Fri, 26 Apr 2024 21:55:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168561; cv=none; b=Il18EaD2BLsDgUet5s9d+bQ7wYP5o77NruLd+WjlCIRRk5zDN9fujvpI3JT/mK1t9ffxpyiSOOhepLysuxYBm3VJNVzhwKfqPoHb9SU0VLZ2YbVskfmSrR5wAdBtlVfqMUTWFwIve5PrxIxWsF1VN18TRTbwqwe99UK6Bsd3sK8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168561; c=relaxed/simple; bh=88ugbT2+2h1rA4xQ9NmilQ8m7sDInZEAkSGSZP/ec10=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RfZiRgKYZ7AxzsQQd9t+/T3bzJFotnsxGl5uXlJOq1apAafcR0swpzPz4RbOd6oPmrplz194eKD9ljG/xU0MQnt85d/3CqZOYaM8BtoMcXhYazrmxe4NqnTf834veXa7sQkX/TT3AsAg8EhH6KP4Qdbhrs7DTm6cSp2u/Fk7+/o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QozMBnBg; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QozMBnBg" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-1e5715a9ebdso22928065ad.2 for ; Fri, 26 Apr 2024 14:55:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168559; x=1714773359; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=5hEYT4tYL+S9lZVDsXBSgwcpHE3A/zFneyiGShU8eKg=; b=QozMBnBgYmIfvIrlJUv7tPjzfodkS0LtE8bnVdReVzCKuKgFGW2lhVb8bOco1QBSF/ cvJfr7CL1UBDtvssd1gGzIFcFSBuKrs2acsECIXKO+B9C12naeUxw0/iuPVLTrC3sbHG xaL9mdOTD6T8Uv0FKvyZPLKbvQ257yb8fgANOIxen/WvekUp9mdawfl/upeQ63drDdyB a5XvRO0SNUPTDAkYLphIkZRg+AowLAwuK1uFmpemNgwXMoNb8C3MPu9GXRgjTBy8nF7g z45KM8z045g6FvSgdqguSPPNRQyyLa8nk1kUR2DNftdSJz0ESJcQdzujVEPO/7/0ij+M 3yJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168559; x=1714773359; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=5hEYT4tYL+S9lZVDsXBSgwcpHE3A/zFneyiGShU8eKg=; b=ML8TETpMOuUWvC2WZgyVM6ptXkHTrczGOTRhp8gGcybKPZ1ZUpJLiXFNp1VlBCSVMq 0Mdiszl3Gln1nY3LwWIy8+FKhuZLrwWFisf8Ymd8gAxHkPCHmZxU+QHXP6YjM4F9kLLD i++uht8O+PAP9VgcV8xb6sjHgN3VNlc+ph2ETa+036S90Abcy3n3tq50sgZzc9PfB16v P3YzwMGKIHEohaSCCqm05I7jcyCBJ98DgAcmisbZg9TYRCT9dA3cIY4zOcROq5R6MWu3 fd9sFRXMeZqlNn7r8ahXbw9Ux/Q0njkMOxZvOB+v8WKNu33bbt95y3W5/9EeITi0nMDY 0txA== X-Gm-Message-State: AOJu0Yy0kZvrQeuRU2G6L8NNBNTXE2eoSWuDcKUXFlqGaci4SKSrIsn5 y72QZGfeHz4y3KgQgv3lrx23br/mNB/nFtVGD6suMzraqOeTLcec4yQXBWUv X-Google-Smtp-Source: AGHT+IHbYvPM/dAnU7KBKHTKFz3EjdkIiHBksTHcA+p1QSY+bolYVeZw9tE8HNvOhbAh5OgpLHqccQ== X-Received: by 2002:a17:902:d50a:b0:1e4:436e:801b with SMTP id b10-20020a170902d50a00b001e4436e801bmr1186583plg.67.1714168559105; Fri, 26 Apr 2024 14:55:59 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:58 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Dave Chinner , Pengfei Xu , Brian Foster , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 10/24] xfs: fix off-by-one-block in xfs_discard_folio() Date: Fri, 26 Apr 2024 14:54:57 -0700 Message-ID: <20240426215512.2673806-11-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Dave Chinner [ Upstream commit 8ac5b996bf5199f15b7687ceae989f8b2a410dda ] The recent writeback corruption fixes changed the code in xfs_discard_folio() to calculate a byte range to for punching delalloc extents. A mistake was made in using round_up(pos) for the end offset, because when pos points at the first byte of a block, it does not get rounded up to point to the end byte of the block. hence the punch range is short, and this leads to unexpected behaviour in certain cases in xfs_bmap_punch_delalloc_range. e.g. pos = 0 means we call xfs_bmap_punch_delalloc_range(0,0), so there is no previous extent and it rounds up the punch to the end of the delalloc extent it found at offset 0, not the end of the range given to xfs_bmap_punch_delalloc_range(). Fix this by handling the zero block offset case correctly. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=217030 Link: https://lore.kernel.org/linux-xfs/Y+vOfaxIWX1c%2Fyy9@bfoster/ Fixes: 7348b322332d ("xfs: xfs_bmap_punch_delalloc_range() should take a byte range") Reported-by: Pengfei Xu Found-by: Brian Foster Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/xfs_aops.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index a22d90af40c8..21c241e96d48 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -439,15 +439,17 @@ xfs_prepare_ioend( } /* - * If the page has delalloc blocks on it, we need to punch them out before we - * invalidate the page. If we don't, we leave a stale delalloc mapping on the - * inode that can trip up a later direct I/O read operation on the same region. + * If the folio has delalloc blocks on it, the caller is asking us to punch them + * out. If we don't, we can leave a stale delalloc mapping covered by a clean + * page that needs to be dirtied again before the delalloc mapping can be + * converted. This stale delalloc mapping can trip up a later direct I/O read + * operation on the same region. * - * We prevent this by truncating away the delalloc regions on the page. Because + * We prevent this by truncating away the delalloc regions on the folio. Because * they are delalloc, we can do this without needing a transaction. Indeed - if * we get ENOSPC errors, we have to be able to do this truncation without a - * transaction as there is no space left for block reservation (typically why we - * see a ENOSPC in writeback). + * transaction as there is no space left for block reservation (typically why + * we see a ENOSPC in writeback). */ static void xfs_discard_folio( @@ -465,8 +467,13 @@ xfs_discard_folio( "page discard on page "PTR_FMT", inode 0x%llx, pos %llu.", folio, ip->i_ino, pos); + /* + * The end of the punch range is always the offset of the the first + * byte of the next folio. Hence the end offset is only dependent on the + * folio itself and not the start offset that is passed in. + */ error = xfs_bmap_punch_delalloc_range(ip, pos, - round_up(pos, folio_size(folio))); + folio_pos(folio) + folio_size(folio)); if (error && !xfs_is_shutdown(mp)) xfs_alert(mp, "page discard unable to remove delalloc mapping."); From patchwork Fri Apr 26 21:54:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645418 Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF026383B2 for ; Fri, 26 Apr 2024 21:56:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168562; cv=none; b=OKaJPmxrhYG7xyWZ3KaxGUtGowWOzgKSnqcAf6U9DKYKP+KA4FJAwth8jaT3BzJY2hPL6zsdaAP1vq+rvBIX/2lBUIPUPjtp5TpBcTN+rMb0oCOFYzVDQUv7mcYr3b0rH8hf3JopLYTDcpe1UQwgkUcSO71KV6ikXbdG2RM9lgc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168562; c=relaxed/simple; bh=9fo0QuzGJVcMgJplU17wiC/1RrlZ/HJjMY84QOii2Xg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=i7Nt5E6I4PRblDvz/rAm8gcsPoFOQa2hBoSyIRADtbzwXzJwM9DTLFCPfwq6yL8OY/so3YTiQ0tAktwgi0PQx6VYsp+X5IKaoWM9vxZeHTCH/G5C6UZDXolXQjQhFtL4WBoc/9tY5yVvlNt4IKoUZM/pekBPfQjt0IKk8qusoss= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PlGd+um2; arc=none smtp.client-ip=209.85.214.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PlGd+um2" Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-1e9451d8b71so23623235ad.0 for ; Fri, 26 Apr 2024 14:56:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168560; x=1714773360; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Jiioweh5N51NsKHBPZ9ZmL/TJNNNyVsMEPm2nRc65SQ=; b=PlGd+um2ta5pHe8jErtNrT+mEYYf9SkJTX/pAbxLecv2H4MZpyuaMDeddD8MaAgnXA V5m+7r/xFx9awi4nlYr5T38fEZU/mCHl8Kcnv1niCY9+8vs2ko0e54OGq33tF8BT7w0H 1dquE/tpVnZmW8JbW8I7cLZu54H1YqenJr89SA6qM+XoUEtQmEOZERKB6lzyRJ6T4EI5 rsJh5ipF8lN+L8rfXUOkynloSZ2TduR0X3nuRoXRTpHMb3ouMeGWK7izCb8CEYKhxIqV /ugqZ6URBOUb58Icra8/LoqLEssn9g7MIizezbeXEQmTVp6Y0fi+v7lxSx1VoBW0QtOj TiGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168560; x=1714773360; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Jiioweh5N51NsKHBPZ9ZmL/TJNNNyVsMEPm2nRc65SQ=; b=vzV6h6QUr/Tj3rirSLIXs8aBcsOuIvUOnDmsjdx7ZoAORRdX0GNx/XTAwBON5N4cV+ nihuLsyJPFgc40FrhFWMKywkhM6E/vFeQj7x8zuLjVOnVHILWbbZOSd8z1+2+T5T6GA4 XcGGxMg8jqsDjRAnIR/JnewvJSTuOh1GrBG/n7HlBAGyRqHT0Q99Fmgp7qXIhdfalqZf 10DdUs1z7apzyNGOVBYnec1Xvvh39EaxV5MrEhZfG820W310WYTRkeIDD1lIHEnUkCuG 2aVnxVI1cmLqnWSGNn4B1dteBTJa4JST+jNN6K3toPz2ZhAklO6R6N3PeQfnKQLyjdC6 +J5A== X-Gm-Message-State: AOJu0Yxcbj2kx+7qdzFWVnIxJzA5RDeB3Vrcrgz6ZNAvdMkFE9EIJhxe Sl+47lw7tJgRKmoaZ4rx7d4MUKCWtlQ3qkmAaa494O3g2LGpbvBBMzrLdDXL X-Google-Smtp-Source: AGHT+IEksw2j8U5UTDwU489aygsMj7SRrw8E0GwkmofYz7MVdZJIMguhQC065E7DOvnT0LbP5g4lGQ== X-Received: by 2002:a17:902:7086:b0:1e3:ca5a:2d9a with SMTP id z6-20020a170902708600b001e3ca5a2d9amr3725106plk.53.1714168560067; Fri, 26 Apr 2024 14:56:00 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.55.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:55:59 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, "Darrick J. Wong" , Andrey Albershteyn , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 11/24] xfs: fix incorrect error-out in xfs_remove Date: Fri, 26 Apr 2024 14:54:58 -0700 Message-ID: <20240426215512.2673806-12-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: "Darrick J. Wong" [ Upstream commit 2653d53345bda90604f673bb211dd060a5a5c232 ] Clean up resources if resetting the dotdot entry doesn't succeed. Observed through code inspection. Fixes: 5838d0356bb3 ("xfs: reset child dir '..' entry when unlinking child") Signed-off-by: Darrick J. Wong Reviewed-by: Andrey Albershteyn Signed-off-by: Leah Rumancik --- fs/xfs/xfs_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c index aa303be11576..d354ea2b74f9 100644 --- a/fs/xfs/xfs_inode.c +++ b/fs/xfs/xfs_inode.c @@ -2479,7 +2479,7 @@ xfs_remove( error = xfs_dir_replace(tp, ip, &xfs_name_dotdot, tp->t_mountp->m_sb.sb_rootino, 0); if (error) - return error; + goto out_trans_cancel; } } else { /* From patchwork Fri Apr 26 21:54:59 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645419 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F333E38DC3 for ; Fri, 26 Apr 2024 21:56:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168563; cv=none; b=gKo09STHfm1RXgg/t+Y6LCDuTDHsG5EKKJ1aZ8eK3nya4UIRvODdkCuITUflBaJ3usamKhIV74vf9zX6nj1gmDL2LK6GSraCepDvaJTMQlAsw67J8WfqXR5/gDHLPZoROCjDm79fimvq4YwVukmcyjSJx2bOM7IJnRgDo1RxTLA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168563; c=relaxed/simple; bh=bk3lpnetHLN3B3aWPqzKx8lv0E490khl9xgMBPEhMSY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uVahcPwR3CQxUBsgy18HAnzD1QxEr5vG7Q9PHObDzK3ydEc/QhPFrLtEbuEx4G7g/RAZec0HpVNzMuFIN4uR+rJOUAeHK/5ziIVvTGN6dc6mjjYyB5JZhdXhot3kaR6D8ky7l/v2M3INzHpULy5kue89lfZRBdKdtCLYu/HD5Cg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Yx4VgtFM; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Yx4VgtFM" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-1e9451d8b71so23623365ad.0 for ; Fri, 26 Apr 2024 14:56:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168561; x=1714773361; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=eUdKEAlR9Lv7qwu40BEj3Ujyv05MVk4KCVWcoRXZqek=; b=Yx4VgtFM93jD1AsKkUlEzY5rXuZF+PByxsMDvAFBtn76Sji0yUUCKseGDHWY403bvp Bluky2cj3Jnhu6Ti3qJqanH223eli1pQ2NOBOQG2zYg17o9gTbTa9eRldDuJEFHD74BK X4cSKRcxvkQIRYLeEZfN1Shgy53GHOopoGtGB2hL51+J8U+xY7SD9UVOHfijSRkVaRTv xx9JCE2BfV+avJb3EdXkbQpJCTVxL9qRdswaZm0yxsdJ+4DNFEZm5IcJpGWaSuPYyKcV YlMCDKQgPuwSFGALIZu9jGZz6LgVY3wyas8qaB13KHShQ/kmXFLE7PRFX4n+i4EaNXEH g0pg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168561; x=1714773361; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=eUdKEAlR9Lv7qwu40BEj3Ujyv05MVk4KCVWcoRXZqek=; b=WyfmpuphRGpvyQxPpkBBwngWn21xT5zfmvKWUnHxH9FO+ghQzSoga9rTJrHi9ESWvS M5DisCp3b9sbKNC4GcWTk7FjQo1SgtgswigyVpFQtsouaxuQrck7bOd5wNFd5spTSc+U pI5ccUqjH1S2krAEeg9bjJMBvUFDBRZPg1DAaVQWlz398ok7ru2W1aaZW7rS0ZRDjrb4 yDVQncVZ+wzGhvndqKR8G40L059k6/KjlG5qG/A/RRfvJS9wjvx+zRY4NDNqo/VFiOOC RZm1FiXlaaKEcRfi5OgmQ1UWKcgxDb+Ztfgw5t5uMjBnWPqDqfHzTKB5hyaZScJi2SFo BJlQ== X-Gm-Message-State: AOJu0Yz98Jx0YakJJjZrCLcI7h4EF8pRrJ7VbfOJ446Y5nhjy1Snse+7 RAj8LJwnBUYv+sCaw1VW/ODrC2eKFje8O9gwWngFXOYDoML9cOabzTMbFlcA X-Google-Smtp-Source: AGHT+IGhokCYfq5HKcDiOGEHYwLada4ZLMsFqz+YmyvzwTVRnwlmDXjORLg0LwML96qFBZWEHoQf6Q== X-Received: by 2002:a17:902:d48f:b0:1eb:4c47:3454 with SMTP id c15-20020a170902d48f00b001eb4c473454mr791757plg.0.1714168561020; Fri, 26 Apr 2024 14:56:01 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:00 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Long Li , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 12/24] xfs: fix sb write verify for lazysbcount Date: Fri, 26 Apr 2024 14:54:59 -0700 Message-ID: <20240426215512.2673806-13-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Long Li [ Upstream commit 59f6ab40fd8735c9a1a15401610a31cc06a0bbd6 ] When lazysbcount is enabled, fsstress and loop mount/unmount test report the following problems: XFS (loop0): SB summary counter sanity check failed XFS (loop0): Metadata corruption detected at xfs_sb_write_verify+0x13b/0x460, xfs_sb block 0x0 XFS (loop0): Unmount and run xfs_repair XFS (loop0): First 128 bytes of corrupted metadata buffer: 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 28 00 00 XFSB.........(.. 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000020: 69 fb 7c cd 5f dc 44 af 85 74 e0 cc d4 e3 34 5a i.|._.D..t....4Z 00000030: 00 00 00 00 00 20 00 06 00 00 00 00 00 00 00 80 ..... .......... 00000040: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 00000050: 00 00 00 01 00 0a 00 00 00 00 00 04 00 00 00 00 ................ 00000060: 00 00 0a 00 b4 b5 02 00 02 00 00 08 00 00 00 00 ................ 00000070: 00 00 00 00 00 00 00 00 0c 09 09 03 14 00 00 19 ................ XFS (loop0): Corruption of in-memory data (0x8) detected at _xfs_buf_ioapply +0xe1e/0x10e0 (fs/xfs/xfs_buf.c:1580). Shutting down filesystem. XFS (loop0): Please unmount the filesystem and rectify the problem(s) XFS (loop0): log mount/recovery failed: error -117 XFS (loop0): log mount failed This corruption will shutdown the file system and the file system will no longer be mountable. The following script can reproduce the problem, but it may take a long time. #!/bin/bash device=/dev/sda testdir=/mnt/test round=0 function fail() { echo "$*" exit 1 } mkdir -p $testdir while [ $round -lt 10000 ] do echo "******* round $round ********" mkfs.xfs -f $device mount $device $testdir || fail "mount failed!" fsstress -d $testdir -l 0 -n 10000 -p 4 >/dev/null & sleep 4 killall -w fsstress umount $testdir xfs_repair -e $device > /dev/null if [ $? -eq 2 ];then echo "ERR CODE 2: Dirty log exception during repair." exit 1 fi round=$(($round+1)) done With lazysbcount is enabled, There is no additional lock protection for reading m_ifree and m_icount in xfs_log_sb(), if other cpu modifies the m_ifree, this will make the m_ifree greater than m_icount. For example, consider the following sequence and ifreedelta is postive: CPU0 CPU1 xfs_log_sb xfs_trans_unreserve_and_mod_sb ---------- ------------------------------ percpu_counter_sum(&mp->m_icount) percpu_counter_add_batch(&mp->m_icount, idelta, XFS_ICOUNT_BATCH) percpu_counter_add(&mp->m_ifree, ifreedelta); percpu_counter_sum(&mp->m_ifree) After this, incorrect inode count (sb_ifree > sb_icount) will be writen to the log. In the subsequent writing of sb, incorrect inode count (sb_ifree > sb_icount) will fail to pass the boundary check in xfs_validate_sb_write() that cause the file system shutdown. When lazysbcount is enabled, we don't need to guarantee that Lazy sb counters are completely correct, but we do need to guarantee that sb_ifree <= sb_icount. On the other hand, the constraint that m_ifree <= m_icount must be satisfied any time that there /cannot/ be other threads allocating or freeing inode chunks. If the constraint is violated under these circumstances, sb_i{count,free} (the ondisk superblock inode counters) maybe incorrect and need to be marked sick at unmount, the count will be rebuilt on the next mount. Fixes: 8756a5af1819 ("libxfs: add more bounds checking to sb sanity checks") Signed-off-by: Long Li Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/libxfs/xfs_sb.c | 4 +++- fs/xfs/xfs_mount.c | 15 +++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c index b6a584e044be..28c464307817 100644 --- a/fs/xfs/libxfs/xfs_sb.c +++ b/fs/xfs/libxfs/xfs_sb.c @@ -973,7 +973,9 @@ xfs_log_sb( */ if (xfs_has_lazysbcount(mp)) { mp->m_sb.sb_icount = percpu_counter_sum(&mp->m_icount); - mp->m_sb.sb_ifree = percpu_counter_sum(&mp->m_ifree); + mp->m_sb.sb_ifree = min_t(uint64_t, + percpu_counter_sum(&mp->m_ifree), + mp->m_sb.sb_icount); mp->m_sb.sb_fdblocks = percpu_counter_sum(&mp->m_fdblocks); } diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c index e8bb3c2e847e..fb87ffb48f7f 100644 --- a/fs/xfs/xfs_mount.c +++ b/fs/xfs/xfs_mount.c @@ -538,6 +538,20 @@ xfs_check_summary_counts( return 0; } +static void +xfs_unmount_check( + struct xfs_mount *mp) +{ + if (xfs_is_shutdown(mp)) + return; + + if (percpu_counter_sum(&mp->m_ifree) > + percpu_counter_sum(&mp->m_icount)) { + xfs_alert(mp, "ifree/icount mismatch at unmount"); + xfs_fs_mark_sick(mp, XFS_SICK_FS_COUNTERS); + } +} + /* * Flush and reclaim dirty inodes in preparation for unmount. Inodes and * internal inode structures can be sitting in the CIL and AIL at this point, @@ -1077,6 +1091,7 @@ xfs_unmountfs( if (error) xfs_warn(mp, "Unable to free reserved block pool. " "Freespace may not be correct on next mount."); + xfs_unmount_check(mp); xfs_log_unmount(mp); xfs_da_unmount(mp); From patchwork Fri Apr 26 21:55:00 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645420 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E305438DE8 for ; Fri, 26 Apr 2024 21:56:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168564; cv=none; b=sJPdpOvIo2EzNCg/ODacDrtE1UuPdL8GQMl7dLdS9awOjV3rPEVDSsQu09xvppPzkzW7wI9EDvgucSMpMVI7fcRH9Zv6dq6L0+KQ/rrSd48shSG/vq6yMKVIbylRH1ttCne0ayRQCiattTPovfoatFDbdr0dg4EWAn9QFna4cF4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168564; c=relaxed/simple; bh=i8IsRUlgnLu13aDmR4B/+ZCHKCTqPEvoTxJGMA1rKWA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=h+bM+SG8zNAAqQ7pcZlXbEzNKjydXLML4+hcF70TVqNj0BQuUl5N3DyT+HgoBsIc9JJ8rmHakD61NjJwbhTHiTgw2ARC89ESdRSGqtN+NQPZfr0WbIzA/gu8UsBPwHst7TOCj82SkE2lK7WNg6VztWYySjTqYYXnQvLk3fSsdhU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=X30syMXM; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="X30syMXM" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-1e3ca4fe4cfso20198145ad.2 for ; Fri, 26 Apr 2024 14:56:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168562; x=1714773362; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=FLKtpsrnk0K3LTK1AqAbvKTAf5YdKNbZ1P7dlKwCa0U=; b=X30syMXMa7vfDV849N27cYpGt3FG0aWl3/x7oaXIYtLRWGfVYOEBzZXdsBcgn4xnoY xUB9vyG3Y934PmMBAS3dd7q9HMN2h755W89Q7KTf8vzucaH/bE9jTmep01l7hi9S4UnU 58dmA4sFwzUySgWQ+VTXsRl3C+8xyY0It8Mp5WbCuoEyZZI8SjUuEkaaW0pdJCTEpggK IthDMOD2Ctm6apmQ8jnlHSnGouAwgbDe5UXddDtXuWuO5mZltD+cVcYBD79YOrm+skHX IDRVasbD+by8El3T2MvD3qkj7l1VqxDmrhE3lM+LBxB793T7nfXoOfbdjW15M01X/3Rf +4Kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168562; x=1714773362; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=FLKtpsrnk0K3LTK1AqAbvKTAf5YdKNbZ1P7dlKwCa0U=; b=qr8037qQDRAl8XJfa5IbJedpgyPnTm5UKi36Dd7si7PStojURgVlFujKf0rQ1Wdoba 2LtAAcZ7bYVjknRjCaMW7BPqMlTShYb6ikDQ2azUPQkEGbofg+nlkQGATeYhNzp5t89y dXB4mIHYcdnnC5WbiZML3C27F1LNKu96Nv8oZofhc1/mBMbmec7e870wG+urnhvzRmMv X8N8zHx4TyPJQ9sWIu1P2XNr/TwVJ14qlh+lXQ0EhPAwZqFY87Dl1VBQtP0WE7985xu/ pef8uUJAo8O9kdhboHBJD0b3QoXXpldTXPsf2RP37W2Csvy9X6cx7RGvL4lfPt4zyX+k 6eTw== X-Gm-Message-State: AOJu0YxLq03zVPEIBsfhgdau7K3Xl/GOfatLq8WsFxKUyP5zSwqqBNB9 BtGuyUZQuo2PhuQ8whXO5pvcban3kiwmhEIRdAQe5ujxEVsVtYFm2C8hmbb0 X-Google-Smtp-Source: AGHT+IGpJpO2xK2ekJ+gFCSECEhOH7EMvNGXQWpMBu852oUK2g7r+6ldUWCxnINGHIFQdHAoTl4ezQ== X-Received: by 2002:a17:903:18e:b0:1e6:766c:6a26 with SMTP id z14-20020a170903018e00b001e6766c6a26mr5168155plg.12.1714168561980; Fri, 26 Apr 2024 14:56:01 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:01 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Long Li , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 13/24] xfs: fix incorrect i_nlink caused by inode racing Date: Fri, 26 Apr 2024 14:55:00 -0700 Message-ID: <20240426215512.2673806-14-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Long Li [ Upstream commit 28b4b0596343d19d140da059eee0e5c2b5328731 ] The following error occurred during the fsstress test: XFS: Assertion failed: VFS_I(ip)->i_nlink >= 2, file: fs/xfs/xfs_inode.c, line: 2452 The problem was that inode race condition causes incorrect i_nlink to be written to disk, and then it is read into memory. Consider the following call graph, inodes that are marked as both XFS_IFLUSHING and XFS_IRECLAIMABLE, i_nlink will be reset to 1 and then restored to original value in xfs_reinit_inode(). Therefore, the i_nlink of directory on disk may be set to 1. xfsaild xfs_inode_item_push xfs_iflush_cluster xfs_iflush xfs_inode_to_disk xfs_iget xfs_iget_cache_hit xfs_iget_recycle xfs_reinit_inode inode_init_always xfs_reinit_inode() needs to hold the ILOCK_EXCL as it is changing internal inode state and can race with other RCU protected inode lookups. On the read side, xfs_iflush_cluster() grabs the ILOCK_SHARED while under rcu + ip->i_flags_lock, and so xfs_iflush/xfs_inode_to_disk() are protected from racing inode updates (during transactions) by that lock. Fixes: ff7bebeb91f8 ("xfs: refactor the inode recycling code") # goes further back than this Signed-off-by: Long Li Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/xfs_icache.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index d884cba1d707..dd5a664c294f 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -342,6 +342,9 @@ xfs_iget_recycle( trace_xfs_iget_recycle(ip); + if (!xfs_ilock_nowait(ip, XFS_ILOCK_EXCL)) + return -EAGAIN; + /* * We need to make it look like the inode is being reclaimed to prevent * the actual reclaim workers from stomping over us while we recycle @@ -355,6 +358,7 @@ xfs_iget_recycle( ASSERT(!rwsem_is_locked(&inode->i_rwsem)); error = xfs_reinit_inode(mp, inode); + xfs_iunlock(ip, XFS_ILOCK_EXCL); if (error) { /* * Re-initializing the inode failed, and we are in deep @@ -523,6 +527,8 @@ xfs_iget_cache_hit( if (ip->i_flags & XFS_IRECLAIMABLE) { /* Drops i_flags_lock and RCU read lock. */ error = xfs_iget_recycle(pag, ip); + if (error == -EAGAIN) + goto out_skip; if (error) return error; } else { From patchwork Fri Apr 26 21:55:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645421 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7DC238F82 for ; Fri, 26 Apr 2024 21:56:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168565; cv=none; b=JfgSUTgJ748LLZIDe2KWLtqqdAgiSuzX4ZCG/RPw8aao1K80TrNzTr0l4saAeq/RPyv7tzvams8srwvPGxjqMnvST5UVaT5kiRTn5oozo0tUAVJrHXD+AeXBKdqCsv+JhP5/L/VuUu6vL2kCtsSKGMSadM2qfkKKqyew9sZ6nP0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168565; c=relaxed/simple; bh=B3gztKCcvuBinrC7FtzDV9IFiRHY08MUU0Q/4bjgyhI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eiDyTiSKbnU/lg19DeiGyoppe8NZ6J5H5gzl7i+r7RPY9lciRKvmH6wcL8ymoCN6VafKPJOaqiORUVh6mJSg1oscskE5eSe4mXC+qV7mTP5ag4edNbNSO/5JuHhycatsR9Qz8EwQK2ja7qYFGbJKf2CQxsdDGtiUe7+eu64Ydw4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=h+B7UkRX; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="h+B7UkRX" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-6ed112c64beso2620007b3a.1 for ; Fri, 26 Apr 2024 14:56:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168563; x=1714773363; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=y1vf5yCfbFIZaQ93LPInJPX/XpHUz5DT96bZkz73Ios=; b=h+B7UkRXLoDUZugMkQ9+c2CGczXWR+vjCI6dGfJou+mZcMiUbDNx5XdYBIIdhERqKW BFOvhg+twsiPrwizBOvyOuAHmJjQbgCBkUD8GhEiHSIWR7Ww0h9GOTiVDAK5PPMci3v6 uuPOr5uu14lwCxGlpehbQ4otKGcKUsWqGrqIa5MPVZbvfozMh9d0cCkCg9HNGyP5y+HB aTWOD425LFaHD2Y6/iPodxlV00w4h/d+MKFHDrc/begkWEkfMcNT8M4l2GcSSGd+FOf8 7ekC4Yb+I795HORvF/M4adMpUzp+buNexUaDphhdFx2Pgb7/7Sq+DOU8XbbmL5jJwBsn giIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168563; x=1714773363; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=y1vf5yCfbFIZaQ93LPInJPX/XpHUz5DT96bZkz73Ios=; b=KO3R2Pk+DDLKIjOQKUTKrsOhIAc9n4l9RElQXJX8X6WcZ/QjsqGUkx7ROdTnXI+zA9 dnTz016Ov3TMoIe3oKKEcQ7B9nevM0AlWb/jT1sIfISeUXgLSjJuePe4SdPIILxwnGQi uNolBaZsrcSUxnUhkJaav62qVscC30baXHi4ze6AamNAmD7fcWHIW1KUK0GiTArqWced GW1m8JRfH/6YvasWNTlxDvJ0ApmoK8rTkfsVHb70efMNPRDVm08ZYSWbClv9pOKUl/pX jIIKYoTU97v1SHO7YN8DDEkts9OMy1O7h6c11VSk5s9cMsFHcS+JRL+LfNM5js0vNhsA ObYg== X-Gm-Message-State: AOJu0YyOgYbWntzmsM+WxlISQA1u4WzMUQAE6+NPt2909SUeJ9tGaiX6 De8c2FVz+SQFWC3tTYfodGYqGzzHOd8CJJkqTXJfEPm4FQZz+p3wfSn/1RVL X-Google-Smtp-Source: AGHT+IFvXzM80Vx32QNQMhBTP7TKiL/F80WvzU4b8SKqvRBOcjyMtvHx8nLXUJfO/cT+8iSFmeJoyg== X-Received: by 2002:a17:903:1cd:b0:1e4:cb0e:2988 with SMTP id e13-20020a17090301cd00b001e4cb0e2988mr1342042plh.2.1714168563040; Fri, 26 Apr 2024 14:56:03 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:02 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, "Darrick J. Wong" , Gao Xiang , Dave Chinner , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 14/24] xfs: invalidate block device page cache during unmount Date: Fri, 26 Apr 2024 14:55:01 -0700 Message-ID: <20240426215512.2673806-15-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: "Darrick J. Wong" [ Upstream commit 032e160305f6872e590c77f11896fb28365c6d6c ] Every now and then I see fstests failures on aarch64 (64k pages) that trigger on the following sequence: mkfs.xfs $dev mount $dev $mnt touch $mnt/a umount $mnt xfs_db -c 'path /a' -c 'print' $dev 99% of the time this succeeds, but every now and then xfs_db cannot find /a and fails. This turns out to be a race involving udev/blkid, the page cache for the block device, and the xfs_db process. udev is triggered whenever anyone closes a block device or unmounts it. The default udev rules invoke blkid to read the fs super and create symlinks to the bdev under /dev/disk. For this, it uses buffered reads through the page cache. xfs_db also uses buffered reads to examine metadata. There is no coordination between xfs_db and udev, which means that they can run concurrently. Note there is no coordination between the kernel and blkid either. On a system with 64k pages, the page cache can cache the superblock and the root inode (and hence the root dir) with the same 64k page. If udev spawns blkid after the mkfs and the system is busy enough that it is still running when xfs_db starts up, they'll both read from the same page in the pagecache. The unmount writes updated inode metadata to disk directly. The XFS buffer cache does not use the bdev pagecache, nor does it invalidate the pagecache on umount. If the above scenario occurs, the pagecache no longer reflects what's on disk, xfs_db reads the stale metadata, and fails to find /a. Most of the time this succeeds because closing a bdev invalidates the page cache, but when processes race, everyone loses. Fix the problem by invalidating the bdev pagecache after flushing the bdev, so that xfs_db will see up to date metadata. Signed-off-by: Darrick J. Wong Reviewed-by: Gao Xiang Reviewed-by: Dave Chinner Signed-off-by: Leah Rumancik --- fs/xfs/xfs_buf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c index dde346450952..54c774af6e1c 100644 --- a/fs/xfs/xfs_buf.c +++ b/fs/xfs/xfs_buf.c @@ -1945,6 +1945,7 @@ xfs_free_buftarg( list_lru_destroy(&btp->bt_lru); blkdev_issue_flush(btp->bt_bdev); + invalidate_bdev(btp->bt_bdev); fs_put_dax(btp->bt_daxdev, btp->bt_mount); kmem_free(btp); From patchwork Fri Apr 26 21:55:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645422 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 112A538F9C for ; Fri, 26 Apr 2024 21:56:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168566; cv=none; b=NCyQURCbiP1F+M1WvaqLCBw6TwyA95u+p1hk+v/iN9nAyG8K0T1myiKiTy1MBGQGx7GSFbUxw3FION5MYy7oOnZTfRabWOmxB86UpvUKr3NqnThLaPNWWqj4S/hn3nK0ZkDp7gR4QYPYCQzzCzRpQMgfBKWq3PHwD2GFRLZ2nCg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168566; c=relaxed/simple; bh=lKWj+A+6Geg3knTDu04Ekq7yei1wMit/JDhaUC++eTs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gUjpITsuXdJITfverodm0ZP1+g81diQftnzgg1oHHDTtxX9hEgQDh/W44XFHtfmKIm+ohppLqrC/V5h0RNstjgPJE82N4eyiRfwzfr4jIvfGPWsQWTu5wvZR9w3YOPhJPXx1CQ+3sgN1s6IG1uqzRya7xVaJrMBhQftbWW+26sY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=amPej8Ph; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="amPej8Ph" Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-1e5c7d087e1so24211035ad.0 for ; Fri, 26 Apr 2024 14:56:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168564; x=1714773364; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=rHkOjOBlJX6eTTzXowp+zeMCB89DR2w2wGeNo3xZt3k=; b=amPej8PhhgU77v7K2FCSfna2iWHqau+5cxq4CzisBLfHSBBAz4mS+bK5EXVduB2MeL O0N78OAqV22fQaixtRSGzDQyw8/rSLGW/FNPobsAyiSYSzjZ5hM58qHX0CwplmBU1zVq Vu71i0ctQaXnrcYhjenXs0pPCTn5jUukB0pc9h8Gt2bWCwPavrLBbDShdEAD1Rad+yiT ky4HTz+LKBVe3FhKWiZkwcfXE7xJT7paW/n2vEfpKSK4lE7b/JFzWBiiM2f+2g1067kk OBVNbaii1QhNskfaa6h8kvgbGzwAan1oW994MpO8G5QUWpJgd5BD4EQecBA1eT8RRoB5 VQNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168564; x=1714773364; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=rHkOjOBlJX6eTTzXowp+zeMCB89DR2w2wGeNo3xZt3k=; b=AwfHTKPKT1WRIIzLjCVme723YRTDZrSczKYHrDejq3ZDvWyXFllsbo3mmnD4L4lBjQ 6xsU+QLUj23XCswXdVLjmErg+2SoPDNSRYL32zpv1UatIj1E1Xa5RMIQJ8ePXQKLltCy 7DMuMk0gnnlUhj5EVyVQb2GQ7guLLJjVERBeA8UDHsumZJQtZuH27RTI/KNrt5SYLKxT Dticw5MbefW36k5efrFBFmMZLbJue7/G3QjGfmOdwrGCUm3I86vevgwv/gw3OAcFlrqz rVP71OzwaXtyaco2NnlUtQERu8zcANV1E1Er0lA52UlUxpmt6biRqiv4XuGqKHrL5XBr 9vrQ== X-Gm-Message-State: AOJu0YxUNYmhDxR8PS45LAjDl2VfDN6TX7sHWVDO0dLMqYa9/xBSRBZJ lgfx2vI/kKFdYT+1fvAJIqTJ/ItrHgG6gH9SbESyi6t+ntuVP/U4DwbKFvK7 X-Google-Smtp-Source: AGHT+IEHV8nlEi6XIzLDAEGNLTVV84W33+AMe7O9xNjKiNKGQ1dk80I4BDKgsWa5rtgv+4kF8WdNjw== X-Received: by 2002:a17:903:2342:b0:1e9:43c:d176 with SMTP id c2-20020a170903234200b001e9043cd176mr4895080plh.12.1714168564304; Fri, 26 Apr 2024 14:56:04 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:03 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, "Darrick J. Wong" , Dave Chinner , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 15/24] xfs: attach dquots to inode before reading data/cow fork mappings Date: Fri, 26 Apr 2024 14:55:02 -0700 Message-ID: <20240426215512.2673806-16-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: "Darrick J. Wong" [ Upstream commit 4c6dbfd2756bd83a0085ed804e2bb7be9cc16bc5 ] I've been running near-continuous integration testing of online fsck, and I've noticed that once a day, one of the ARM VMs will fail the test with out of order records in the data fork. xfs/804 races fsstress with online scrub (aka scan but do not change anything), so I think this might be a bug in the core xfs code. This also only seems to trigger if one runs the test for more than ~6 minutes via TIME_FACTOR=13 or something. https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfstests-dev.git/tree/tests/xfs/804?h=djwong-wtf I added a debugging patch to the kernel to check the data fork extents after taking the ILOCK, before dropping ILOCK, and before and after each bmapping operation. So far I've narrowed it down to the delalloc code inserting a record in the wrong place in the iext tree: xfs_bmap_add_extent_hole_delay, near line 2691: case 0: /* * New allocation is not contiguous with another * delayed allocation. * Insert a new entry. */ oldlen = newlen = 0; xfs_iunlock_check_datafork(ip); <-- ok here xfs_iext_insert(ip, icur, new, state); xfs_iunlock_check_datafork(ip); <-- bad here break; } I recorded the state of the data fork mappings and iext cursor state when a corrupt data fork is detected immediately after the xfs_bmap_add_extent_hole_delay call in xfs_bmapi_reserve_delalloc: ino 0x140bb3 func xfs_bmapi_reserve_delalloc line 4164 data fork: ino 0x140bb3 nr 0x0 nr_real 0x0 offset 0xb9 blockcount 0x1f startblock 0x935de2 state 1 ino 0x140bb3 nr 0x1 nr_real 0x1 offset 0xe6 blockcount 0xa startblock 0xffffffffe0007 state 0 ino 0x140bb3 nr 0x2 nr_real 0x1 offset 0xd8 blockcount 0xe startblock 0x935e01 state 0 Here we see that a delalloc extent was inserted into the wrong position in the iext leaf, same as all the other times. The extra trace data I collected are as follows: ino 0x140bb3 fork 0 oldoff 0xe6 oldlen 0x4 oldprealloc 0x6 isize 0xe6000 ino 0x140bb3 oldgotoff 0xea oldgotstart 0xfffffffffffffffe oldgotcount 0x0 oldgotstate 0 ino 0x140bb3 crapgotoff 0x0 crapgotstart 0x0 crapgotcount 0x0 crapgotstate 0 ino 0x140bb3 freshgotoff 0xd8 freshgotstart 0x935e01 freshgotcount 0xe freshgotstate 0 ino 0x140bb3 nowgotoff 0xe6 nowgotstart 0xffffffffe0007 nowgotcount 0xa nowgotstate 0 ino 0x140bb3 oldicurpos 1 oldleafnr 2 oldleaf 0xfffffc00f0609a00 ino 0x140bb3 crapicurpos 2 crapleafnr 2 crapleaf 0xfffffc00f0609a00 ino 0x140bb3 freshicurpos 1 freshleafnr 2 freshleaf 0xfffffc00f0609a00 ino 0x140bb3 newicurpos 1 newleafnr 3 newleaf 0xfffffc00f0609a00 The first line shows that xfs_bmapi_reserve_delalloc was called with whichfork=XFS_DATA_FORK, off=0xe6, len=0x4, prealloc=6. The second line ("oldgot") shows the contents of @got at the beginning of the call, which are the results of the first iext lookup in xfs_buffered_write_iomap_begin. Line 3 ("crapgot") is the result of duplicating the cursor at the start of the body of xfs_bmapi_reserve_delalloc and performing a fresh lookup at @off. Line 4 ("freshgot") is the result of a new xfs_iext_get_extent right before the call to xfs_bmap_add_extent_hole_delay. Totally garbage. Line 5 ("nowgot") is contents of @got after the xfs_bmap_add_extent_hole_delay call. Line 6 is the contents of @icur at the beginning fo the call. Lines 7-9 are the contents of the iext cursors at the point where the block mappings were sampled. I think @oldgot is a HOLESTARTBLOCK extent because the first lookup didn't find anything, so we filled in imap with "fake hole until the end". At the time of the first lookup, I suspect that there's only one 32-block unwritten extent in the mapping (hence oldicurpos==1) but by the time we get to recording crapgot, crapicurpos==2. Dave then added: Ok, that's much simpler to reason about, and implies the smoke is coming from xfs_buffered_write_iomap_begin() or xfs_bmapi_reserve_delalloc(). I suspect the former - it does a lot of stuff with the ILOCK_EXCL held..... .... including calling xfs_qm_dqattach_locked(). xfs_buffered_write_iomap_begin ILOCK_EXCL look up icur xfs_qm_dqattach_locked xfs_qm_dqattach_one xfs_qm_dqget_inode dquot cache miss xfs_iunlock(ip, XFS_ILOCK_EXCL); error = xfs_qm_dqread(mp, id, type, can_alloc, &dqp); xfs_ilock(ip, XFS_ILOCK_EXCL); .... xfs_bmapi_reserve_delalloc(icur) Yup, that's what is letting the magic smoke out - xfs_qm_dqattach_locked() can cycle the ILOCK. If that happens, we can pass a stale icur to xfs_bmapi_reserve_delalloc() and it all goes downhill from there. Back to Darrick now: So. Fix this by moving the dqattach_locked call up before we take the ILOCK, like all the other callers in that file. Fixes: a526c85c2236 ("xfs: move xfs_file_iomap_begin_delay around") # goes further back than this Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Leah Rumancik --- fs/xfs/xfs_iomap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index 1bdd7afc1010..ab5512c0bcf7 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -968,6 +968,10 @@ xfs_buffered_write_iomap_begin( ASSERT(!XFS_IS_REALTIME_INODE(ip)); + error = xfs_qm_dqattach(ip); + if (error) + return error; + error = xfs_ilock_for_iomap(ip, flags, &lockmode); if (error) return error; @@ -1071,10 +1075,6 @@ xfs_buffered_write_iomap_begin( allocfork = XFS_COW_FORK; } - error = xfs_qm_dqattach_locked(ip, false); - if (error) - goto out_unlock; - if (eof && offset + count > XFS_ISIZE(ip)) { /* * Determine the initial size of the preallocation. From patchwork Fri Apr 26 21:55:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645423 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2728839AC9 for ; Fri, 26 Apr 2024 21:56:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168567; cv=none; b=rgTCNwoYIaJpKm8XltEwAfHPEnTTqfIiIyl+qFhYulTEY8HhhRaF0NumuZ9V4BZBKlnSmAyJfDB93ay+ftsvnAM5SldBLU/+Bzzlkf0mxGWJcDrsEjEVKj+LEpUuVPNTeHU7VUgvVTAvglAO018RwlNjHNiwH7ZE/Jmpb/2KUJE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168567; c=relaxed/simple; bh=6uk+2WxLHNjTTKlmhCHxepIhGMfJxTwWXI2LN7LqvuQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KO1qQwAI2C2wqQNSz/+b1ENVPJ9UHaCQr1ZyuhA3HKyi3eCEdXRLjhrTRL2o/z+uEYNdgfVoGKZJGoOlKPFBJomq7OhPzZ2ziWzbFKFb1bd8Vs64zD2ceRkkf9APMv9JUW/CIrYSAFPXw3RgYzXdnQTK/EfsJRLQv+H4NYg/PdI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=knKsGi4+; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="knKsGi4+" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-1e2bbc2048eso23650225ad.3 for ; Fri, 26 Apr 2024 14:56:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168565; x=1714773365; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=3rGIpsEaqo3AXvtkX7lKcoPk4kfA1H5etWusTtsTmGE=; b=knKsGi4+kF9ZNiXwKsv4TrHwAl/zy3MaIhcCh4aMek9tQremyu5GgvwChLcpUNnBQu LIAu8TCdGvAdPKBxcS1AszZkA8j+Zom4/NIeJrO+yejgmRcCGjiS3Pd9j/+wYTTaZO8W 8uRlazLY/fF+E7QSzY6A7EiZXR5nzVx2TGA+DrZCxdU6xVhgjNaSDTTJpdEh49/CpHUr kfAgtDyM0JtBkEHf1jzYV+nbiJvX1mGb1Hm/xHmpRnHw8kkMSOnASYlwLCYA3iAiq6rI 4nXfBqKDpvt3zNd1TeoR3uoppYK8ob+vdFtlEOnm19ET0bq3sMk71SjXrv66RL9hz5TE i+Lg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168565; x=1714773365; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3rGIpsEaqo3AXvtkX7lKcoPk4kfA1H5etWusTtsTmGE=; b=t2WMLMhsBUB0Vpw6nNOOZHqyDOjy2IfKyw+PbecapugI2XI8uYPn8/ib27V11V9w1X tJ99DaWT34Zacm2/qHCWlexGC5Rve6uyLaFQrOekxrlbr9mKHKciBhdwDgs/T7EdN8Pm WUP2tCldqT2B4bz4cXNmnDwRX3i7B0ZBu7luk1e0Fj7tDfmSNVO2cVXb0YZEnq24+ONZ edAIyYPrpEb2FG55awlqyK3l4uvZZrtsXZ1J16BXCdL0Ch4U+Eox7FKNTapiPmwp7YLO nSX8SCH5l+/8UkoJickETw+tU+XdKHvaMiwcNI9fAF/fkssoAKD3WWy9C8PgAW/kMvd2 Tlig== X-Gm-Message-State: AOJu0YxcRc815C/40T0FFsipll7oKUkJL5fdA6aF3SmAw7nj3nhm7OSD o2lBuOgBV/HqGxSUY3mgYW3xAtY3jdcD1x7Se3AltJTGD7CUshyiZFSUc8AB X-Google-Smtp-Source: AGHT+IEHAbxXZoDQf8n6+1LvHTrvfyOrYFcy7QDXm8CesqrXiNqdVIkkqtkrLUMOrPN8LrI8gIzjuw== X-Received: by 2002:a17:902:e809:b0:1e1:6850:f823 with SMTP id u9-20020a170902e80900b001e16850f823mr4846319plg.13.1714168565496; Fri, 26 Apr 2024 14:56:05 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:05 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Guo Xuenan , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 16/24] xfs: wait iclog complete before tearing down AIL Date: Fri, 26 Apr 2024 14:55:03 -0700 Message-ID: <20240426215512.2673806-17-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Guo Xuenan [ Upstream commit 1eb52a6a71981b80f9acbd915acd6a05a5037196 ] Fix uaf in xfs_trans_ail_delete during xlog force shutdown. In commit cd6f79d1fb32 ("xfs: run callbacks before waking waiters in xlog_state_shutdown_callbacks") changed the order of running callbacks and wait for iclog completion to avoid unmount path untimely destroy AIL. But which seems not enough to ensue this, adding mdelay in `xfs_buf_item_unpin` can prove that. The reproduction is as follows. To ensure destroy AIL safely, we should wait all xlog ioend workers done and sync the AIL. ================================================================== BUG: KASAN: use-after-free in xfs_trans_ail_delete+0x240/0x2a0 Read of size 8 at addr ffff888023169400 by task kworker/1:1H/43 CPU: 1 PID: 43 Comm: kworker/1:1H Tainted: G W 6.1.0-rc1-00002-gc28266863c4a #137 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: xfs-log/sda xlog_ioend_work Call Trace: dump_stack_lvl+0x4d/0x66 print_report+0x171/0x4a6 kasan_report+0xb3/0x130 xfs_trans_ail_delete+0x240/0x2a0 xfs_buf_item_done+0x7b/0xa0 xfs_buf_ioend+0x1e9/0x11f0 xfs_buf_item_unpin+0x4c8/0x860 xfs_trans_committed_bulk+0x4c2/0x7c0 xlog_cil_committed+0xab6/0xfb0 xlog_cil_process_committed+0x117/0x1e0 xlog_state_shutdown_callbacks+0x208/0x440 xlog_force_shutdown+0x1b3/0x3a0 xlog_ioend_work+0xef/0x1d0 process_one_work+0x6f9/0xf70 worker_thread+0x578/0xf30 kthread+0x28c/0x330 ret_from_fork+0x1f/0x30 Allocated by task 9606: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 __kmalloc+0x59/0x140 kmem_alloc+0xb2/0x2f0 xfs_trans_ail_init+0x20/0x320 xfs_log_mount+0x37e/0x690 xfs_mountfs+0xe36/0x1b40 xfs_fs_fill_super+0xc5c/0x1a70 get_tree_bdev+0x3c5/0x6c0 vfs_get_tree+0x85/0x250 path_mount+0xec3/0x1830 do_mount+0xef/0x110 __x64_sys_mount+0x150/0x1f0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9662: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 __kasan_slab_free+0x105/0x1a0 __kmem_cache_free+0x99/0x2d0 kvfree+0x3a/0x40 xfs_log_unmount+0x60/0xf0 xfs_unmountfs+0xf3/0x1d0 xfs_fs_put_super+0x78/0x300 generic_shutdown_super+0x151/0x400 kill_block_super+0x9a/0xe0 deactivate_locked_super+0x82/0xe0 deactivate_super+0x91/0xb0 cleanup_mnt+0x32a/0x4a0 task_work_run+0x15f/0x240 exit_to_user_mode_prepare+0x188/0x190 syscall_exit_to_user_mode+0x12/0x30 do_syscall_64+0x42/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff888023169400 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 0 bytes inside of 128-byte region [ffff888023169400, ffff888023169480) The buggy address belongs to the physical page: page:ffffea00008c5a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888023168f80 pfn:0x23168 head:ffffea00008c5a00 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x1fffff80010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 001fffff80010200 ffffea00006b3988 ffffea0000577a88 ffff88800f842ac0 raw: ffff888023168f80 0000000000150007 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888023169300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888023169380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888023169400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888023169480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888023169500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint Fixes: cd6f79d1fb32 ("xfs: run callbacks before waking waiters in xlog_state_shutdown_callbacks") Signed-off-by: Guo Xuenan Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/xfs_log.c | 36 +++++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-) diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c index f02a0dd522b3..60b19f6d7077 100644 --- a/fs/xfs/xfs_log.c +++ b/fs/xfs/xfs_log.c @@ -886,6 +886,23 @@ xlog_force_iclog( return xlog_state_release_iclog(iclog->ic_log, iclog, NULL); } +/* + * Cycle all the iclogbuf locks to make sure all log IO completion + * is done before we tear down these buffers. + */ +static void +xlog_wait_iclog_completion(struct xlog *log) +{ + int i; + struct xlog_in_core *iclog = log->l_iclog; + + for (i = 0; i < log->l_iclog_bufs; i++) { + down(&iclog->ic_sema); + up(&iclog->ic_sema); + iclog = iclog->ic_next; + } +} + /* * Wait for the iclog and all prior iclogs to be written disk as required by the * log force state machine. Waiting on ic_force_wait ensures iclog completions @@ -1111,6 +1128,14 @@ xfs_log_unmount( { xfs_log_clean(mp); + /* + * If shutdown has come from iclog IO context, the log + * cleaning will have been skipped and so we need to wait + * for the iclog to complete shutdown processing before we + * tear anything down. + */ + xlog_wait_iclog_completion(mp->m_log); + xfs_buftarg_drain(mp->m_ddev_targp); xfs_trans_ail_destroy(mp); @@ -2113,17 +2138,6 @@ xlog_dealloc_log( xlog_in_core_t *iclog, *next_iclog; int i; - /* - * Cycle all the iclogbuf locks to make sure all log IO completion - * is done before we tear down these buffers. - */ - iclog = log->l_iclog; - for (i = 0; i < log->l_iclog_bufs; i++) { - down(&iclog->ic_sema); - up(&iclog->ic_sema); - iclog = iclog->ic_next; - } - /* * Destroy the CIL after waiting for iclog IO completion because an * iclog EIO error will try to shut down the log, which accesses the From patchwork Fri Apr 26 21:55:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645424 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6337639FF2 for ; Fri, 26 Apr 2024 21:56:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168568; cv=none; b=eILDfMPOQdXir/nGCnWzq9+c0yEyeldpFCXBOKYG+xrZY1oCCSfZdF+GY8vJTTpKd++hh0VnngMZ33OX9oO+wJLVBq+2fKZEOXGwp8JJe5qmicuRCXZ0523JmcIPrURp6Jliihz3d/GwV10jZFbCyxJlbL7nwcIinBR8+JXE76o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168568; c=relaxed/simple; bh=K0CYLz+X0WaXFgwOIZ9fp3/KM0f7gN+QqCDJ8lRzRwI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NUR/grq24w3t9zG0GeVWIjprYCLMB8uT1ES7w0HYDzMZ8Z8nUFigQ74nnnKX+jScCTxW6gFA53AmPO7Nz/MZ8oOQaxyzxXsaPQwsVSiBsTKbjlO22LIVCGTEClV//XlqKqyckUyK6hjCtLSSY2g9nJyiVMyNQIPRlDp4TGg8r7E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=An0n5bdu; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="An0n5bdu" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-1e3ff14f249so20158225ad.1 for ; Fri, 26 Apr 2024 14:56:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168566; x=1714773366; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Y6LUDHkv9eYKxn5TY/+wGN2T9MmB63zoVimXrOLrpvw=; b=An0n5bduarcPDMux+Wp/2rsStbGTEsnRp1ZJlN6MJpsjz4AbXPTBwP5Bud1LISfgLD QmMwNZxDpMb7H6vU5asRh30zUq4PKystBsIpu3YFZIV1czzl4eknxo2uWdqTVXGaY9wQ X0GMbQ7njhhZuY1dS8kJY0Jr4DHD9AEYBv4OV5CGtUTHL44l/gIq1tMpXeK1J6g3CaZc M2/EEZ88kr7xIxYumsM3izVDCp18czwrEsovYeES/XiEseEpNc+iiRcr+k6AMKMziZyF Vxd1BfFKxmBnK/jz8kdW5rzBv5DFvRJHsR/+qvhmkzIuBGeN353LIIbh7H81o+FraJZj cMLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168566; x=1714773366; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Y6LUDHkv9eYKxn5TY/+wGN2T9MmB63zoVimXrOLrpvw=; b=ER5J7wzKxlRG02aXKSY2Xbgm9X7XAKK4dbfEHTymdIwa0K026Hzjs2Rw/tvLtNAEwP 0tKgmXVtR4Q4i8mKFY3JeZDeHH3vPm0FXfJAHN+8jSYtXwNfbem5u8WdYzqtuiFDMYNQ 9o0CF2zvqcBI3KOflpGcuXsiV0EKjJi8Flg/kBR5SE3nwS4yk72xAPo2K8d1ANNEyHMK LxkC4NCxA+SdiMvIzoeikWozk5nhMfWoWzlLqS71oiCYf4dw3n1zZaS9J5TxsV+QxpK8 amC5z5PcAy5PbKTQKuApudtagbTxyYysQWUoLzjqoD2LS77btFxrg0Dsj2U0qlk7u9mm qZUA== X-Gm-Message-State: AOJu0YyqPlWkZekDBTL/vBhazChjkmRrcasVJk9poVSf4KVLOuGUMjd+ ccFPfLe9WaypiYmvVTKIgO81wixHu+/HeayobW0YYCBiGSL1fyoG/ISh2Fa4 X-Google-Smtp-Source: AGHT+IF3mGN2BhcM7Mjv6dRXH7lrvSPsEGHlDzmfceQmklC2DrY+PM91hyiviN3/NqGgCxYUGaAG0w== X-Received: by 2002:a17:902:d50a:b0:1eb:4930:58d3 with SMTP id b10-20020a170902d50a00b001eb493058d3mr814463plg.4.1714168566572; Fri, 26 Apr 2024 14:56:06 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:06 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Guo Xuenan , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 17/24] xfs: fix super block buf log item UAF during force shutdown Date: Fri, 26 Apr 2024 14:55:04 -0700 Message-ID: <20240426215512.2673806-18-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Guo Xuenan [ Upstream commit 575689fc0ffa6c4bb4e72fd18e31a6525a6124e0 ] xfs log io error will trigger xlog shut down, and end_io worker call xlog_state_shutdown_callbacks to unpin and release the buf log item. The race condition is that when there are some thread doing transaction commit and happened not to be intercepted by xlog_is_shutdown, then, these log item will be insert into CIL, when unpin and release these buf log item, UAF will occur. BTW, add delay before `xlog_cil_commit` can increase recurrence probability. The following call graph actually encountered this bad situation. fsstress io end worker kworker/0:1H-216 xlog_ioend_work ->xlog_force_shutdown ->xlog_state_shutdown_callbacks ->xlog_cil_process_committed ->xlog_cil_committed ->xfs_trans_committed_bulk ->xfs_trans_apply_sb_deltas ->li_ops->iop_unpin(lip, 1); ->xfs_trans_getsb ->_xfs_trans_bjoin ->xfs_buf_item_init ->if (bip) { return 0;} //relog ->xlog_cil_commit ->xlog_cil_insert_items //insert into CIL ->xfs_buf_ioend_fail(bp); ->xfs_buf_ioend ->xfs_buf_item_done ->xfs_buf_item_relse ->xfs_buf_item_free when cil push worker gather percpu cil and insert super block buf log item into ctx->log_items then uaf occurs. ================================================================== BUG: KASAN: use-after-free in xlog_cil_push_work+0x1c8f/0x22f0 Write of size 8 at addr ffff88801800f3f0 by task kworker/u4:4/105 CPU: 0 PID: 105 Comm: kworker/u4:4 Tainted: G W 6.1.0-rc1-00001-g274115149b42 #136 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: xfs-cil/sda xlog_cil_push_work Call Trace: dump_stack_lvl+0x4d/0x66 print_report+0x171/0x4a6 kasan_report+0xb3/0x130 xlog_cil_push_work+0x1c8f/0x22f0 process_one_work+0x6f9/0xf70 worker_thread+0x578/0xf30 kthread+0x28c/0x330 ret_from_fork+0x1f/0x30 Allocated by task 2145: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x14a/0x510 xfs_buf_item_init+0x160/0x6d0 _xfs_trans_bjoin+0x7f/0x2e0 xfs_trans_getsb+0xb6/0x3f0 xfs_trans_apply_sb_deltas+0x1f/0x8c0 __xfs_trans_commit+0xa25/0xe10 xfs_symlink+0xe23/0x1660 xfs_vn_symlink+0x157/0x280 vfs_symlink+0x491/0x790 do_symlinkat+0x128/0x220 __x64_sys_symlink+0x7a/0x90 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 216: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 __kasan_slab_free+0x105/0x1a0 kmem_cache_free+0xb6/0x460 xfs_buf_ioend+0x1e9/0x11f0 xfs_buf_item_unpin+0x3d6/0x840 xfs_trans_committed_bulk+0x4c2/0x7c0 xlog_cil_committed+0xab6/0xfb0 xlog_cil_process_committed+0x117/0x1e0 xlog_state_shutdown_callbacks+0x208/0x440 xlog_force_shutdown+0x1b3/0x3a0 xlog_ioend_work+0xef/0x1d0 process_one_work+0x6f9/0xf70 worker_thread+0x578/0xf30 kthread+0x28c/0x330 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff88801800f388 which belongs to the cache xfs_buf_item of size 272 The buggy address is located 104 bytes inside of 272-byte region [ffff88801800f388, ffff88801800f498) The buggy address belongs to the physical page: page:ffffea0000600380 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801800f208 pfn:0x1800e head:ffffea0000600380 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x1fffff80010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 001fffff80010200 ffffea0000699788 ffff88801319db50 ffff88800fb50640 raw: ffff88801800f208 000000000015000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88801800f280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801800f300: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88801800f380: fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801800f400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801800f480: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint Signed-off-by: Guo Xuenan Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/xfs_buf_item.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c index 522d450a94b1..df7322ed73fa 100644 --- a/fs/xfs/xfs_buf_item.c +++ b/fs/xfs/xfs_buf_item.c @@ -1018,6 +1018,8 @@ xfs_buf_item_relse( trace_xfs_buf_item_relse(bp, _RET_IP_); ASSERT(!test_bit(XFS_LI_IN_AIL, &bip->bli_item.li_flags)); + if (atomic_read(&bip->bli_refcount)) + return; bp->b_log_item = NULL; xfs_buf_rele(bp); xfs_buf_item_free(bip); From patchwork Fri Apr 26 21:55:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645425 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 644373A1B9 for ; Fri, 26 Apr 2024 21:56:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168569; cv=none; b=gKpyuj4VdqvQ+aJ9S60jSdHgFF3LVhG3iAz9hRqp7f8wlbkp59RpPIzEF8ZHXIBf6lt4gldztqqGjrNomLKUdnbN66PXcGfuQQhaYwp9SPB9R/5p2cWLbr4T51Db+k6dgmx35nQCAT1E6oeZ1CAX+RRYhI5NUW6vg2/83fE1nJY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168569; c=relaxed/simple; bh=J/WYcXvRiLzch+6h6hgq+qzl+PgaTZ5Vn/Zr6VuhAok=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BTJzvc6H/5KSMEq+6g/FbD+4bdo8FUxNq7ff7OPfLXl5vZfqxm5SujZ8PshgnAiUUmGW+NXl3j7D8qt5GzMHcMlzC6cq/tWtzcTfS4TNhPtt44Ln2v51BDGQ0VrerXxZh6+wVrDVH1575EEDuX3bXD/URk7gD+xz2aI/Zr3UNUU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WUxZyjJw; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WUxZyjJw" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-1e8f68f8e0dso19617595ad.3 for ; Fri, 26 Apr 2024 14:56:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168568; x=1714773368; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=njkvQk9fwdhBmNn3nsfX35b2DXTrgzvFuq0Yw0RR6rg=; b=WUxZyjJwSHzUgVoRd0kim/j7CwPk3EMzYa085122dlq1tQkYQgnyjgPq0YfxUB228O ZQSovhbnPsLv4A5kNBorjxHvgWvUXUlOU/e4lxi/7EbzrhXnjUfGczRDGoV2++ulaTfh nAFGeUbRNVOB4NDCAotBg9OeaeFBYt6AFzF2k6BsiBWc0IxH4Rkv+61/pVEeIF3YYi4m df0wtxdXA0JDinN46BeAs7r+vyfo45bb+D05t673nhbH4rg4SGCs7a1nL/OvOOLw0H07 d2Ou643kEFjkDyvbA+ZZjN3NhqRgjq+Afrfwd8XeaTjSmpAnzqVQ5LVbT31ws7gsOicc CgEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168568; x=1714773368; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=njkvQk9fwdhBmNn3nsfX35b2DXTrgzvFuq0Yw0RR6rg=; b=nH5otqsgrAxmJJmWNvy8kFTtbhZ+4IqsA2dJ80JW5NAdqIbSs/ZeFQOM2FC4+F3CEl miy7YBsNYvjLHkuuGiI/M7KvanRd2I8fFc3X4wezsCruWipRwyTjDuJA4higArMY3YqP szuX2tt7af3Fvwmr7YlR+ZQrOOZKg5wO+hv4XlqqY15gsm5dZpCOwpCV/1GvYf25e8PY r4kAPifWjYFi3pMfFNFON3Rcg9qDErXK1eXyxxinxiQGIupxxFjJFc2mhjtQ4H3dajSh M+NtdxIL0wemt1PDvAquDWMnx0F0xA+vGvw/AGzlpmuOPItnc0VkwgtC8suy1BYV1upX C4Yw== X-Gm-Message-State: AOJu0YyLkvZUqKi0sPH3G3twiFWP/VWKCXRH0qcrh9DaISp9++h+9o0m 4RVVOPSLAgC4LHTO0/9VxwvanWSDLKVs5k++FBmZ+zTad5FSaY8rTERU+YjB X-Google-Smtp-Source: AGHT+IENlw2oWf0i6w02mZfYDRhQaYvOIuRr7d6Yw3O3giYbTIPnlXqNfsHxxFR9zTX/ynyoufHufg== X-Received: by 2002:a17:902:6b45:b0:1e2:6165:8086 with SMTP id g5-20020a1709026b4500b001e261658086mr841221plt.61.1714168567619; Fri, 26 Apr 2024 14:56:07 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:07 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, "Darrick J. Wong" , Dave Chinner , Xiao Yang , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 18/24] xfs: hoist refcount record merge predicates Date: Fri, 26 Apr 2024 14:55:05 -0700 Message-ID: <20240426215512.2673806-19-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: "Darrick J. Wong" [ Upstream commit 9d720a5a658f5135861773f26e927449bef93d61 ] Hoist these multiline conditionals into separate static inline helpers to improve readability and set the stage for corruption fixes that will be introduced in the next patch. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Xiao Yang Signed-off-by: Leah Rumancik --- fs/xfs/libxfs/xfs_refcount.c | 129 ++++++++++++++++++++++++++++++----- 1 file changed, 113 insertions(+), 16 deletions(-) diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c index 3f34bafe18dd..4408893333a6 100644 --- a/fs/xfs/libxfs/xfs_refcount.c +++ b/fs/xfs/libxfs/xfs_refcount.c @@ -815,11 +815,119 @@ xfs_refcount_find_right_extents( /* Is this extent valid? */ static inline bool xfs_refc_valid( - struct xfs_refcount_irec *rc) + const struct xfs_refcount_irec *rc) { return rc->rc_startblock != NULLAGBLOCK; } +static inline bool +xfs_refc_want_merge_center( + const struct xfs_refcount_irec *left, + const struct xfs_refcount_irec *cleft, + const struct xfs_refcount_irec *cright, + const struct xfs_refcount_irec *right, + bool cleft_is_cright, + enum xfs_refc_adjust_op adjust, + unsigned long long *ulenp) +{ + unsigned long long ulen = left->rc_blockcount; + + /* + * To merge with a center record, both shoulder records must be + * adjacent to the record we want to adjust. This is only true if + * find_left and find_right made all four records valid. + */ + if (!xfs_refc_valid(left) || !xfs_refc_valid(right) || + !xfs_refc_valid(cleft) || !xfs_refc_valid(cright)) + return false; + + /* There must only be one record for the entire range. */ + if (!cleft_is_cright) + return false; + + /* The shoulder record refcounts must match the new refcount. */ + if (left->rc_refcount != cleft->rc_refcount + adjust) + return false; + if (right->rc_refcount != cleft->rc_refcount + adjust) + return false; + + /* + * The new record cannot exceed the max length. ulen is a ULL as the + * individual record block counts can be up to (u32 - 1) in length + * hence we need to catch u32 addition overflows here. + */ + ulen += cleft->rc_blockcount + right->rc_blockcount; + if (ulen >= MAXREFCEXTLEN) + return false; + + *ulenp = ulen; + return true; +} + +static inline bool +xfs_refc_want_merge_left( + const struct xfs_refcount_irec *left, + const struct xfs_refcount_irec *cleft, + enum xfs_refc_adjust_op adjust) +{ + unsigned long long ulen = left->rc_blockcount; + + /* + * For a left merge, the left shoulder record must be adjacent to the + * start of the range. If this is true, find_left made left and cleft + * contain valid contents. + */ + if (!xfs_refc_valid(left) || !xfs_refc_valid(cleft)) + return false; + + /* Left shoulder record refcount must match the new refcount. */ + if (left->rc_refcount != cleft->rc_refcount + adjust) + return false; + + /* + * The new record cannot exceed the max length. ulen is a ULL as the + * individual record block counts can be up to (u32 - 1) in length + * hence we need to catch u32 addition overflows here. + */ + ulen += cleft->rc_blockcount; + if (ulen >= MAXREFCEXTLEN) + return false; + + return true; +} + +static inline bool +xfs_refc_want_merge_right( + const struct xfs_refcount_irec *cright, + const struct xfs_refcount_irec *right, + enum xfs_refc_adjust_op adjust) +{ + unsigned long long ulen = right->rc_blockcount; + + /* + * For a right merge, the right shoulder record must be adjacent to the + * end of the range. If this is true, find_right made cright and right + * contain valid contents. + */ + if (!xfs_refc_valid(right) || !xfs_refc_valid(cright)) + return false; + + /* Right shoulder record refcount must match the new refcount. */ + if (right->rc_refcount != cright->rc_refcount + adjust) + return false; + + /* + * The new record cannot exceed the max length. ulen is a ULL as the + * individual record block counts can be up to (u32 - 1) in length + * hence we need to catch u32 addition overflows here. + */ + ulen += cright->rc_blockcount; + if (ulen >= MAXREFCEXTLEN) + return false; + + return true; +} + /* * Try to merge with any extents on the boundaries of the adjustment range. */ @@ -861,23 +969,15 @@ xfs_refcount_merge_extents( (cleft.rc_blockcount == cright.rc_blockcount); /* Try to merge left, cleft, and right. cleft must == cright. */ - ulen = (unsigned long long)left.rc_blockcount + cleft.rc_blockcount + - right.rc_blockcount; - if (xfs_refc_valid(&left) && xfs_refc_valid(&right) && - xfs_refc_valid(&cleft) && xfs_refc_valid(&cright) && cequal && - left.rc_refcount == cleft.rc_refcount + adjust && - right.rc_refcount == cleft.rc_refcount + adjust && - ulen < MAXREFCEXTLEN) { + if (xfs_refc_want_merge_center(&left, &cleft, &cright, &right, cequal, + adjust, &ulen)) { *shape_changed = true; return xfs_refcount_merge_center_extents(cur, &left, &cleft, &right, ulen, aglen); } /* Try to merge left and cleft. */ - ulen = (unsigned long long)left.rc_blockcount + cleft.rc_blockcount; - if (xfs_refc_valid(&left) && xfs_refc_valid(&cleft) && - left.rc_refcount == cleft.rc_refcount + adjust && - ulen < MAXREFCEXTLEN) { + if (xfs_refc_want_merge_left(&left, &cleft, adjust)) { *shape_changed = true; error = xfs_refcount_merge_left_extent(cur, &left, &cleft, agbno, aglen); @@ -893,10 +993,7 @@ xfs_refcount_merge_extents( } /* Try to merge cright and right. */ - ulen = (unsigned long long)right.rc_blockcount + cright.rc_blockcount; - if (xfs_refc_valid(&right) && xfs_refc_valid(&cright) && - right.rc_refcount == cright.rc_refcount + adjust && - ulen < MAXREFCEXTLEN) { + if (xfs_refc_want_merge_right(&cright, &right, adjust)) { *shape_changed = true; return xfs_refcount_merge_right_extent(cur, &right, &cright, aglen); From patchwork Fri Apr 26 21:55:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645426 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3AC73A1DB for ; Fri, 26 Apr 2024 21:56:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168571; cv=none; b=DsnvSTMnT9HoidFAjuSD4qQPYZbs8aa7xNgCSkRGvI2BnljpNL8SgGzDDUyVBZZ+44rJxD+XMUAdwe7cm/kKvwUAolLhllA1FY6obBUZ58z1RlhRVVgpTbCPPhIvffGp/419uZRMoYj24eqybqOjLWrttK8DHWbv7Cppur0CNro= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168571; c=relaxed/simple; bh=BGYxDlgEBNrM/Xk350n6qGbU6rrTMIpEK1TwomqAWzw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=limw3zS9CSH67SETKZVe9SVgJq1bJPsnpiAi3i1KbsOoXntuw4LXae8wnZEqISOfN/qjyI9YHChRwWrN4RS94Edzm7J22hI5epz9D7Wpt3iDC3xQc2AAUBRuNuafLmva/uDRf75Fc25e2UElyPPQ+e/Ud/n/9PVNABOHmSkdwIY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WyG2Rv9m; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WyG2Rv9m" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-1e3ca4fe4cfso20198515ad.2 for ; Fri, 26 Apr 2024 14:56:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168569; x=1714773369; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=TbMO1dyHOlYXIqVrSti+1+Ate8R8MbRlXl2H56MKL4Q=; b=WyG2Rv9mtKcTrAAyvhdz8biuNwO3ll52vzRngT0WF1vNCS6b9KMVEWoVkD32MuUSXZ ul+22yDDYkfRZ+MOFxOJqEPRmQznv/07rszYh2HyjEmkud7UJFPwQ98GmwDHSaqmX6cU G3zQqyeS1JwZ4DEjYaJIBh8kzHQvCBdsWFTU11cizOLsRGNQdnq2emq2ygy/0YNbYamJ GDwlS8DN2139aj9mpoxdbGSs5OuXFiZrVPEJGVf2sf5nahrv2HpBdn7bxxOt6y8ndw6D dIc+c9ZZPiQO27aIQ6UqqTkoK4Htxqsutyqysf0ENBu/WE4xV+WNehk9pZost5ZBLq0m u0Cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168569; x=1714773369; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TbMO1dyHOlYXIqVrSti+1+Ate8R8MbRlXl2H56MKL4Q=; b=ih9wgaH3FJoSFssjn9op5Htaz9NTCU2dVeW1ts1+H3byoYYP0d052zeL3W8K6ZHWgw Tokn9WbsDEO1hdz7m24MbSl1o83KX/jxMldeEPoeQFRZlbB6lruEvIgltCRzDzXDBwz2 UxENwjaAs3RXooF47YPB9eb9r13S5a9HHlSvC5UqKJne4lSFY0hwGkmVk87zPBu4a61j U2aoqeenRH7xZ0VHQelDtdBxXOPbdJvRsiIgWbBbUUoghusNhOmOJ00jcSBCZocZGjBO KqT0pv45dQoM7J1ZUSgHkrhQae5P7r1mWqZz4j0pnMBEybfNwlXPaCh1dAWsb6+BfWIj 3gqw== X-Gm-Message-State: AOJu0Yz44+A5+lmNYFvj5UGTLNwmEihJ+iJS2sznoU2w3cW5l32lmxJH q/7JF2wKEZNf/KLl7CgE0m4fLBl/fpL4qPbEQUJNPoz7824H/lWA40ENCBYo X-Google-Smtp-Source: AGHT+IFSLeSBvy/flXkWlQo3Gtu/BAoq6gQuc3hl+CJW60DE8GziX3/CsIY8cbn8NRkH4pfAUXSCXg== X-Received: by 2002:a17:903:1208:b0:1e3:dfdc:6972 with SMTP id l8-20020a170903120800b001e3dfdc6972mr5098188plh.9.1714168568764; Fri, 26 Apr 2024 14:56:08 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:08 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, "Darrick J. Wong" , Dave Chinner , Xiao Yang , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 19/24] xfs: estimate post-merge refcounts correctly Date: Fri, 26 Apr 2024 14:55:06 -0700 Message-ID: <20240426215512.2673806-20-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: "Darrick J. Wong" [ Upstream commit b25d1984aa884fc91a73a5a407b9ac976d441e9b ] Upon enabling fsdax + reflink for XFS, xfs/179 began to report refcount metadata corruptions after being run. Specifically, xfs_repair noticed single-block refcount records that could be combined but had not been. The root cause of this is improper MAXREFCOUNT edge case handling in xfs_refcount_merge_extents. When we're trying to find candidates for a refcount btree record merge, we compute the refcount attribute of the merged record, but we fail to account for the fact that once a record hits rc_refcount == MAXREFCOUNT, it is pinned that way forever. Hence the computed refcount is wrong, and we fail to merge the extents. Fix this by adjusting the merge predicates to compute the adjusted refcount correctly. Fixes: 3172725814f9 ("xfs: adjust refcount of an extent of blocks in refcount btree") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Xiao Yang Signed-off-by: Leah Rumancik --- fs/xfs/libxfs/xfs_refcount.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c index 4408893333a6..6f7ed9288fe4 100644 --- a/fs/xfs/libxfs/xfs_refcount.c +++ b/fs/xfs/libxfs/xfs_refcount.c @@ -820,6 +820,17 @@ xfs_refc_valid( return rc->rc_startblock != NULLAGBLOCK; } +static inline xfs_nlink_t +xfs_refc_merge_refcount( + const struct xfs_refcount_irec *irec, + enum xfs_refc_adjust_op adjust) +{ + /* Once a record hits MAXREFCOUNT, it is pinned there forever */ + if (irec->rc_refcount == MAXREFCOUNT) + return MAXREFCOUNT; + return irec->rc_refcount + adjust; +} + static inline bool xfs_refc_want_merge_center( const struct xfs_refcount_irec *left, @@ -831,6 +842,7 @@ xfs_refc_want_merge_center( unsigned long long *ulenp) { unsigned long long ulen = left->rc_blockcount; + xfs_nlink_t new_refcount; /* * To merge with a center record, both shoulder records must be @@ -846,9 +858,10 @@ xfs_refc_want_merge_center( return false; /* The shoulder record refcounts must match the new refcount. */ - if (left->rc_refcount != cleft->rc_refcount + adjust) + new_refcount = xfs_refc_merge_refcount(cleft, adjust); + if (left->rc_refcount != new_refcount) return false; - if (right->rc_refcount != cleft->rc_refcount + adjust) + if (right->rc_refcount != new_refcount) return false; /* @@ -871,6 +884,7 @@ xfs_refc_want_merge_left( enum xfs_refc_adjust_op adjust) { unsigned long long ulen = left->rc_blockcount; + xfs_nlink_t new_refcount; /* * For a left merge, the left shoulder record must be adjacent to the @@ -881,7 +895,8 @@ xfs_refc_want_merge_left( return false; /* Left shoulder record refcount must match the new refcount. */ - if (left->rc_refcount != cleft->rc_refcount + adjust) + new_refcount = xfs_refc_merge_refcount(cleft, adjust); + if (left->rc_refcount != new_refcount) return false; /* @@ -903,6 +918,7 @@ xfs_refc_want_merge_right( enum xfs_refc_adjust_op adjust) { unsigned long long ulen = right->rc_blockcount; + xfs_nlink_t new_refcount; /* * For a right merge, the right shoulder record must be adjacent to the @@ -913,7 +929,8 @@ xfs_refc_want_merge_right( return false; /* Right shoulder record refcount must match the new refcount. */ - if (right->rc_refcount != cright->rc_refcount + adjust) + new_refcount = xfs_refc_merge_refcount(cright, adjust); + if (right->rc_refcount != new_refcount) return false; /* From patchwork Fri Apr 26 21:55:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645427 Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A35DD3AC01 for ; Fri, 26 Apr 2024 21:56:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168571; cv=none; b=cfFUqRY2GMF6ZS3oEipNt11Ty33jKSESxPDTffEGYFY2AOX3OfjWrKnJiGQTNK7nPgUq9YgWVtbL5FzD/X/NA7f8BPIjZcCqOreNs0p0xk5rhRz0J/GM89hSPQ/jZB9HFIrI7QEYBtNI4Qg2r3SwWHPa+h6ciKxynjsPFSHLYXI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168571; c=relaxed/simple; bh=XmzbHAvg2b6sJ0iPja5NIyp38GHTvg5TSU3divPaVoU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XnpbwXKpZFiNdAXAnRWhTxt1U/oe2pf9tpmQLfNIBMDQyUnIoZZmPVPoCmOwuJ0OtmoAXT+xUf+c8+jNle780MOKdXP9KbfRCheQNqzs0C7FqR/sliwGxGo3V/2aJRvCD+U2p77ScAYOyEIrtBwhC9HFI1hMBsPiNCmHX4FZWho= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Y5Cj4g3P; arc=none smtp.client-ip=209.85.215.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Y5Cj4g3P" Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-5d8b519e438so2072779a12.1 for ; Fri, 26 Apr 2024 14:56:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168570; x=1714773370; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=pht/K/7CZKwiiqOQN9VzZ+/9t5Cm8B/yBFfj5eXlF9o=; b=Y5Cj4g3PKtBtAe3YbP5SqshNidcIFczTx+CK5dkB2g8NzCc6zSeo6rAnACB+7iN7Cx aOBGWUx++UoiiRLZxE+UihxFR5Dv5sXNCeugSx+mHstqwA6UfBxpvGaW9zm1CEGIGY3h RwJLzp8P0LhsPT9QroNovPIOojJ+J4i3bnwXNjhBI4U12c6r++7uthCDeIzL4mLENyeq FSpgK5rtGTeQSfLzXrkS392x63pjZ8eb8vQxNOA0FMwuLdlo7qDFISJmmq9OcDUflo1S OVhcptrQj4cyQSxOFgnj98hLz7fnNJaawIT0CTMYd1SCJDG59OF+b2fMNyFhBi8elZQl XPHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168570; x=1714773370; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=pht/K/7CZKwiiqOQN9VzZ+/9t5Cm8B/yBFfj5eXlF9o=; b=YYdobYUzSO+gRxqsd5OM1gu1LaRYwyB75BwryOIsr+3Zga99HGXYPHDEW4S6XTrbwH FzeaKOhgUbffNxz9bL79P7nojVUZvuMOumOwFcSXMZZjcl1lIWjEKMM0Rf4PzroYBn+7 /gk8WbWaleCtAjkdJ/mkvYWgzRAbYWC29tj4nIWC+HOb/XLJd1/a1aU340bSDIZf+nTr EdmVkzf38OEzJovczfOEBdH0xAgNZwR5lie1wjXYrjAj4XPTnpl2y9wL3WT9nbfqUnoo iFmFz+AngqnqaGlK3rUnTPn+GFxEkxRQA2ygY+HfhoJH4yoKhYD30joe6Tjcw1pNDTMX L4qg== X-Gm-Message-State: AOJu0YyLX29TOiSb42NtHin4VqRm5wgmiDolBFdL5ZMIqMy/yJbVTtZP Iq7aXxlIiVhvN4Gz+WgPntDFGf+XQ/O2LHTXf6o69wqKUFCmEsLSTabO1TC+ X-Google-Smtp-Source: AGHT+IEVcl6FGXitanH6nqcz9w950sg3/erj0t12/pyTV2CrpCuG92rBDR/p/9VP090rJVScYloucA== X-Received: by 2002:a17:902:f605:b0:1eb:ed2:f74c with SMTP id n5-20020a170902f60500b001eb0ed2f74cmr3511517plg.67.1714168569866; Fri, 26 Apr 2024 14:56:09 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:09 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, "Darrick J. Wong" , Dave Chinner , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 20/24] xfs: invalidate xfs_bufs when allocating cow extents Date: Fri, 26 Apr 2024 14:55:07 -0700 Message-ID: <20240426215512.2673806-21-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: "Darrick J. Wong" [ Upstream commit ddfdd530e43fcb3f7a0a69966e5f6c33497b4ae3 ] While investigating test failures in xfs/17[1-3] in alwayscow mode, I noticed through code inspection that xfs_bmap_alloc_userdata isn't setting XFS_ALLOC_USERDATA when allocating extents for a file's CoW fork. COW staging extents should be flagged as USERDATA, since user data are persisted to these blocks before being remapped into a file. This mis-classification has a few impacts on the behavior of the system. First, the filestreams allocator is supposed to keep allocating from a chosen AG until it runs out of space in that AG. However, it only does that for USERDATA allocations, which means that COW allocations aren't tied to the filestreams AG. Fortunately, few people use filestreams, so nobody's noticed. A more serious problem is that xfs_alloc_ag_vextent_small looks for a buffer to invalidate *if* the USERDATA flag is set and the AG is so full that the allocation had to come from the AGFL because the cntbt is empty. The consequences of not invalidating the buffer are severe -- if the AIL incorrectly checkpoints a buffer that is now being used to store user data, that action will clobber the user's written data. Fix filestreams and yet another data corruption vector by flagging COW allocations as USERDATA. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Leah Rumancik --- fs/xfs/libxfs/xfs_bmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c index 56b9b7db38bb..0d56a8d862e8 100644 --- a/fs/xfs/libxfs/xfs_bmap.c +++ b/fs/xfs/libxfs/xfs_bmap.c @@ -4058,7 +4058,7 @@ xfs_bmap_alloc_userdata( * the busy list. */ bma->datatype = XFS_ALLOC_NOBUSY; - if (whichfork == XFS_DATA_FORK) { + if (whichfork == XFS_DATA_FORK || whichfork == XFS_COW_FORK) { bma->datatype |= XFS_ALLOC_USERDATA; if (bma->offset == 0) bma->datatype |= XFS_ALLOC_INITIAL_USER_DATA; From patchwork Fri Apr 26 21:55:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645428 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC0C73B290 for ; Fri, 26 Apr 2024 21:56:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168573; cv=none; b=qFiDfqK5RDYf4P9qGD+K/j4hBomX1OaXfPq3Osj/oTxfOLRydm9Mz8y7IAL8D3VO1VSLGxo24dM0Px1nzypAnyKLV4IddvPD1YSGsxLcJeRx8xqhxr8orE+8cXE1ssIlxiB2jOJww+C5OEWTqgBuaNL9kQPjHCxBXM5yfPC9Faw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168573; c=relaxed/simple; bh=ZAeie0BqhizVnnmgD4FuucPgIO5gG3Nz+KefeHd8Cd8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=p2uFbx9dCBstxYdkE8zZ85KnXi84iEDX8Ife5R7y/z8dv5/pZSFBghqJoENatCpXQps7LTARZ9banFTYoeTltAS/mgMV895Xr3UShtsUI7vHzWhItxgecQji5K1jkFK0hsZ4wY24skvLAt3enRLIO5jzgQ3bAmxaKp9+8edQiNc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Ryz8NUKl; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Ryz8NUKl" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-1e5715a9ebdso22928835ad.2 for ; Fri, 26 Apr 2024 14:56:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168571; x=1714773371; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NrbvPDJfVbs0FiQOsMs7wCJkoN/sO7lxWFpoPiUL0OI=; b=Ryz8NUKl+9PJnhN9P9eVGwOxomtt94hVUkKn0yhbO/jbkUYTMiclG0o2kk455CxK7P Z1UI2lJbC6TT22D+yWi91RS9k8zRLqFcsUSaPmlLTQunKREb2S01rKFu+c21F40kV8j1 mn2ZTi/ZekMdVW0lhYATHkoAOya9Q5eMlPUsKdP8c4PA+MJrx2de5KjY9KqHTbBYhU7e HogRVDzRuQSWDx+Eb+kLYdlHHWYI1th6pdrCNeGCu9BHmlf6eocIEaLqfpy4gEYiZ6RA yJZLr5qDARYYnW0Mmw/r4iYZdX4CEPx9Eso0P+x9NJy+DWNpIa7IhBInY1shYRqD6he+ OQkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168571; x=1714773371; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NrbvPDJfVbs0FiQOsMs7wCJkoN/sO7lxWFpoPiUL0OI=; b=solND3fAqR57Izjq1gtXKzjHLr2YjADOnvRQtPKR/N/6iltazR2TX8blyUjKAKr/10 bz0XYbiDdGhermsQMoLarN+uI8jSq6qRcnLEcfGMb8ZF9VmsJ0XmRqfIFjH/+C7CIKdU eO9lZ6VId8VSm6Uv2BiyQ260jf6f1VnVTRQikmE59STKZ5qeyuY+kEV+5hnypX8TMSak 8IvwwDIqQiir0pkspdBjwVfdBGwGX/oNDKHsXyqcEKqWTj/lP6J1Ukxt4bBc1zYSOmyF iAoUO4vkHYsbPTbDLhyDr3I+GQS10ZOjpDcU4r0LY82oSPjCrFjovQeyc5pNrs05aHVJ XDlA== X-Gm-Message-State: AOJu0Ywmtu+Sdoi/tiiOgk78NxVvrr2sikhmu8q8zJqV3ifVltXbaGJH MVmOFEG6PwmXHJH5FTgxPp0MiLVKn3kqOVu5smKuXltyThd9Wp66Yo3VIx3h X-Google-Smtp-Source: AGHT+IFWyGFV1QE6JLjllsEY9l78sJdgWuDBTmba7ogiqleq5UxN5vClSChZtirjbHPG6SfLnIwhNA== X-Received: by 2002:a17:902:dac5:b0:1e3:e4ff:7054 with SMTP id q5-20020a170902dac500b001e3e4ff7054mr1212878plx.38.1714168570951; Fri, 26 Apr 2024 14:56:10 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:10 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, "Darrick J. Wong" , Dave Chinner , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 21/24] xfs: allow inode inactivation during a ro mount log recovery Date: Fri, 26 Apr 2024 14:55:08 -0700 Message-ID: <20240426215512.2673806-22-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: "Darrick J. Wong" [ Upstream commit 76e589013fec672c3587d6314f2d1f0aeddc26d9 ] In the next patch, we're going to prohibit log recovery if the primary superblock contains an unrecognized rocompat feature bit even on readonly mounts. This requires removing all the code in the log mounting process that temporarily disables the readonly state. Unfortunately, inode inactivation disables itself on readonly mounts. Clearing the iunlinked lists after log recovery needs inactivation to run to free the unreferenced inodes, which (AFAICT) is the only reason why log mounting plays games with the readonly state in the first place. Therefore, change the inactivation predicates to allow inactivation during log recovery of a readonly mount. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Leah Rumancik --- fs/xfs/xfs_inode.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c index d354ea2b74f9..54b707787f90 100644 --- a/fs/xfs/xfs_inode.c +++ b/fs/xfs/xfs_inode.c @@ -1652,8 +1652,11 @@ xfs_inode_needs_inactive( if (VFS_I(ip)->i_mode == 0) return false; - /* If this is a read-only mount, don't do this (would generate I/O) */ - if (xfs_is_readonly(mp)) + /* + * If this is a read-only mount, don't do this (would generate I/O) + * unless we're in log recovery and cleaning the iunlinked list. + */ + if (xfs_is_readonly(mp) && !xlog_recovery_needed(mp->m_log)) return false; /* If the log isn't running, push inodes straight to reclaim. */ @@ -1713,8 +1716,11 @@ xfs_inactive( mp = ip->i_mount; ASSERT(!xfs_iflags_test(ip, XFS_IRECOVERY)); - /* If this is a read-only mount, don't do this (would generate I/O) */ - if (xfs_is_readonly(mp)) + /* + * If this is a read-only mount, don't do this (would generate I/O) + * unless we're in log recovery and cleaning the iunlinked list. + */ + if (xfs_is_readonly(mp) && !xlog_recovery_needed(mp->m_log)) goto out; /* Metadata inodes require explicit resource cleanup. */ From patchwork Fri Apr 26 21:55:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645429 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83F693B782 for ; Fri, 26 Apr 2024 21:56:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168573; cv=none; b=kwyG0A4FD4sr6QGZXgYOSHh0gApqgBxZ2Q+m2Hk4xwU7+lTWt9mw1J6uYFQgKPiAebQbWRhwgPU4Qvyyp8vxbMMNpBCvxXyLxKJFeik584MLFwaM83yny4oLQKcTzFIUYP3zgNWwi8zF2LV9o/+8c8RcHoplQ1VsbxcgtAWVzxk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168573; c=relaxed/simple; bh=n1LyQTxHOYjIkP96aeq5RE1qIpC98Uo55vPf4aOlwec=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GZgufCD5PZ3XARTbwu+UUXITLbrvlupgJwK3T51fmIRtCZ6Vk18sna07R5Wjjv2ZOu+RnvDFcuFHcq2hWp2AdOqPIlUieutMMH6NZWTFrwll5O8LGYwX9TdlNXEBTPqRqedqQwF7T9XphA5QuS+N4LvTafQLdjXmvtIC4PjzFFQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Q3riNLGG; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q3riNLGG" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-1eac92f7c74so18180325ad.3 for ; Fri, 26 Apr 2024 14:56:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168572; x=1714773372; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=9hNIdm5d+yg3LAm9vN9skzBV5xAcIN1I+3KiZR3PtOI=; b=Q3riNLGGni+1ti/hF+wUqeEQf09rbLSCGwi08DSGuHtB+aHtScxUDlQW+oqbDyN8d0 wEGugBOr0+l+d+wHU+DWPegN/hI1FntnOKj4kaJBO7X7XPzqxkcRGoWMZiS7fvDBz0OL 4DRzAr3aSfhfZP4pd59ShE1pXjyb73kKHZB9rAJ5TEtxCB+NzdQh/ivq5yePSgVV5NR2 bmnPqkOLO8iV6N3/Or/JRaF10+L8UfUz2pFjtBLGbnONAMMjbCRdnt5og2HvS8qF38ZW Ia+nMjyX2Ve4JZ/WhtHzTYbVcWpqlTZMm6J69Mtgp6RTu1DN55VW5aBwgN53XjF+x2Tm L/Cg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168572; x=1714773372; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=9hNIdm5d+yg3LAm9vN9skzBV5xAcIN1I+3KiZR3PtOI=; b=TZ/sD4uQ/Qi01aJ56qjDthcD4nQ+iw2/pU8DGaC1ZyVajoL+I5rbzr/idBTapIw2v4 /jBPqtvmzL8Ff2xjq6eloeRPutz63j+dt0JfCLSGwkwTW1ajCDmSTJcr4DFu5FnpYH9y 61ajLBD3IKCASuHFPi6MV77bL7nGep1S+Df4mpibEjN1sIWEtuQfVpPYgxRiV2OssHwj GT6wAiO0nTDeAoWxZun4vm8xFbyKPMClzyiXq/9uM/kv+DsZ3ViARbHs64H9Dc93dgO6 Ttxr06RW9xfjNgv+HW4yjdZGv23T6EVxJVAP9F7YGYan32VsL3GVVMhqNP4qtyHQcJIg wXeQ== X-Gm-Message-State: AOJu0YzYlDgQ3cXsq5/eIS3tawz9Waa545/S/HcjIb/fyj94v95bsVcj SjRRlY133mDQgSRmNsFBRsSp8Pwp7e2pfrTMP+/lZgkAbKkgW29bcLQKtFXb X-Google-Smtp-Source: AGHT+IH/l2YLzxOu8WG9HZdiWM5ii10swQfVE2jFXaoPsjtae5G3mCHJD3hwwnYlkKx1ACaXP71CgA== X-Received: by 2002:a17:902:cf0e:b0:1e5:2ea7:a0b3 with SMTP id i14-20020a170902cf0e00b001e52ea7a0b3mr5237703plg.62.1714168571866; Fri, 26 Apr 2024 14:56:11 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:11 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, "Darrick J. Wong" , Dave Chinner , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 22/24] xfs: fix log recovery when unknown rocompat bits are set Date: Fri, 26 Apr 2024 14:55:09 -0700 Message-ID: <20240426215512.2673806-23-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: "Darrick J. Wong" [ Upstream commit 74ad4693b6473950e971b3dc525b5ee7570e05d0 ] Log recovery has always run on read only mounts, even where the primary superblock advertises unknown rocompat bits. Due to a misunderstanding between Eric and Darrick back in 2018, we accidentally changed the superblock write verifier to shutdown the fs over that exact scenario. As a result, the log cleaning that occurs at the end of the mounting process fails if there are unknown rocompat bits set. As we now allow writing of the superblock if there are unknown rocompat bits set on a RO mount, we no longer want to turn off RO state to allow log recovery to succeed on a RO mount. Hence we also remove all the (now unnecessary) RO state toggling from the log recovery path. Fixes: 9e037cb7972f ("xfs: check for unknown v5 feature bits in superblock write verifier" Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Leah Rumancik --- fs/xfs/libxfs/xfs_sb.c | 3 ++- fs/xfs/xfs_log.c | 17 ----------------- 2 files changed, 2 insertions(+), 18 deletions(-) diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c index 28c464307817..bf2cca78304e 100644 --- a/fs/xfs/libxfs/xfs_sb.c +++ b/fs/xfs/libxfs/xfs_sb.c @@ -266,7 +266,8 @@ xfs_validate_sb_write( return -EFSCORRUPTED; } - if (xfs_sb_has_ro_compat_feature(sbp, XFS_SB_FEAT_RO_COMPAT_UNKNOWN)) { + if (!xfs_is_readonly(mp) && + xfs_sb_has_ro_compat_feature(sbp, XFS_SB_FEAT_RO_COMPAT_UNKNOWN)) { xfs_alert(mp, "Corruption detected in superblock read-only compatible features (0x%x)!", (sbp->sb_features_ro_compat & diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c index 60b19f6d7077..d9aa5eab02c3 100644 --- a/fs/xfs/xfs_log.c +++ b/fs/xfs/xfs_log.c @@ -730,15 +730,7 @@ xfs_log_mount( * just worked. */ if (!xfs_has_norecovery(mp)) { - /* - * log recovery ignores readonly state and so we need to clear - * mount-based read only state so it can write to disk. - */ - bool readonly = test_and_clear_bit(XFS_OPSTATE_READONLY, - &mp->m_opstate); error = xlog_recover(log); - if (readonly) - set_bit(XFS_OPSTATE_READONLY, &mp->m_opstate); if (error) { xfs_warn(mp, "log mount/recovery failed: error %d", error); @@ -787,7 +779,6 @@ xfs_log_mount_finish( struct xfs_mount *mp) { struct xlog *log = mp->m_log; - bool readonly; int error = 0; if (xfs_has_norecovery(mp)) { @@ -795,12 +786,6 @@ xfs_log_mount_finish( return 0; } - /* - * log recovery ignores readonly state and so we need to clear - * mount-based read only state so it can write to disk. - */ - readonly = test_and_clear_bit(XFS_OPSTATE_READONLY, &mp->m_opstate); - /* * During the second phase of log recovery, we need iget and * iput to behave like they do for an active filesystem. @@ -850,8 +835,6 @@ xfs_log_mount_finish( xfs_buftarg_drain(mp->m_ddev_targp); clear_bit(XLOG_RECOVERY_NEEDED, &log->l_opstate); - if (readonly) - set_bit(XFS_OPSTATE_READONLY, &mp->m_opstate); /* Make sure the log is dead if we're returning failure. */ ASSERT(!error || xlog_is_shutdown(log)); From patchwork Fri Apr 26 21:55:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645430 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8FD913BBC1 for ; Fri, 26 Apr 2024 21:56:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168574; cv=none; b=nFhkj4qsQfhPHO2RgJL6fZiZA271q82ndX7jan/Qe62d1d6aMTTlJlX+CrRhYnXfPbta7p2o8i68O7zidQ9VB90otB/Gk83kbo6I2LYkY4Xz17dy2wNidxkCcFmJj7r5pl7fg4PSlyURSR5GADjxJ6vVLluAvz/qqTmcN+Y65Qs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168574; c=relaxed/simple; bh=SH1qnePCFrRl3fAgZRNYZa8yrIJShfVzGEm4Ck1rCxI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EygeFxAz4RYbmLAy89pjVJoXnNd07PdBoxwZHbQj+ApfiLgPw99E5vFsJ151L4/VldNjfHxJ6fDbu+z18mr47VB7XRnsYKF1ziKkmktMjE4VQdYB0MVUE11HBrksWAWCm/TwMbSgV0f5/Vu1P3VqRW1ln8Vs5ccZO8IgpfS7Z3M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=APhydaYr; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="APhydaYr" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-1e36b7e7dd2so23341115ad.1 for ; Fri, 26 Apr 2024 14:56:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168573; x=1714773373; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=uBlBlpf98C5X0voCh7UOBX1uYrcKQ0GqpvlCauYQYPM=; b=APhydaYr7c7c2tesbjgbXDFOnLnuRE3QofVWWFxrZIIxxoF1Cf1Jm2Z55vOAtPYiff slDRgnhQbGM/rNaaDoINwUpe0eRt5Axe5b6XkKObJQbrsZe3QA1vJp1g3WRZsGoWusZ+ ANeF5t2RWdzdnZdCIRI2WIWDFgxyu8G8e8fQ6RRQLvXG4ztkh7yHbXyqHlQc48/AKfeb z8rH3CLoMHGIaOZYKGJNTekIg3GpddQ7Dzd8reCXkU+LvLpCaex9Ua5umBWjNJrHdOjX 4HsLCEysxto6JQb1Ln3l+UFQewrXeRUZ4lLtJ1pjc6OhT6ZaKXvFIPJ4zs4y3BI/QW4B acNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168573; x=1714773373; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=uBlBlpf98C5X0voCh7UOBX1uYrcKQ0GqpvlCauYQYPM=; b=FvbzwnXEZQs76TKtiqWCCyX8TBIk6r8/f1jcw3n/XjCySRnOMvCIRWVZP3nPutZvqd bi9p+1ZmsHxhgWhlYEOAd2Mq5y2pYzUs/UhCTSbVCFszn2DrIhEDtaEOpou2JNrFD58z nEGYXGWxq36kvLLch9f9RxKlaFUjgoP/Y8yemLkGuK4FIatAQMdEl1ZBpEWlhJby4igI eH5d6do94s7mLVyWEu7Gxwqkdgl8L/Xb9VkxEJNOjyw2dIDvFKJySgyOYJq0fio8uqHu xg+oLKiQsUmFVIM2qo/8ha0p3dAPQKuYUxAEd3eB3QR0aD2/7XK5bcSNY6jH/4/pZ1zX ZUkg== X-Gm-Message-State: AOJu0YwrgRish0h3745jdcLT9yTUJDqgHnb75LwXuiMuEgbGq8JZ7ipA 406nFz9HXTg6ZeiHNo6W0UtePlgdCzK9S1dm+/mbsNDknekC81DedBLaOO4I X-Google-Smtp-Source: AGHT+IGm11uv+Py5P8rTiQvG3CGLJIpJNUT4LDpu3bT+Vj/nxiGRvsVFHH3op4mPzWfeuNHaOxGTzw== X-Received: by 2002:a17:903:2409:b0:1e9:a0ce:f618 with SMTP id e9-20020a170903240900b001e9a0cef618mr1266366plo.69.1714168572907; Fri, 26 Apr 2024 14:56:12 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:12 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Hironori Shiina , Hironori Shiina , "Darrick J . Wong" , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 23/24] xfs: get root inode correctly at bulkstat Date: Fri, 26 Apr 2024 14:55:10 -0700 Message-ID: <20240426215512.2673806-24-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Hironori Shiina [ Upstream commit 817644fa4525258992f17fecf4f1d6cdd2e1b731 ] The root inode number should be set to `breq->startino` for getting stat information of the root when XFS_BULK_IREQ_SPECIAL_ROOT is used. Otherwise, the inode search is started from 1 (XFS_BULK_IREQ_SPECIAL_ROOT) and the inode with the lowest number in a filesystem is returned. Fixes: bf3cb3944792 ("xfs: allow single bulkstat of special inodes") Signed-off-by: Hironori Shiina Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Leah Rumancik --- fs/xfs/xfs_ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c index 1f783e979629..85fbb3b71d1c 100644 --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c @@ -754,7 +754,7 @@ xfs_bulkstat_fmt( static int xfs_bulk_ireq_setup( struct xfs_mount *mp, - struct xfs_bulk_ireq *hdr, + const struct xfs_bulk_ireq *hdr, struct xfs_ibulk *breq, void __user *ubuffer) { @@ -780,7 +780,7 @@ xfs_bulk_ireq_setup( switch (hdr->ino) { case XFS_BULK_IREQ_SPECIAL_ROOT: - hdr->ino = mp->m_sb.sb_rootino; + breq->startino = mp->m_sb.sb_rootino; break; default: return -EINVAL; From patchwork Fri Apr 26 21:55:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leah Rumancik X-Patchwork-Id: 13645431 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 99D433BBCE for ; Fri, 26 Apr 2024 21:56:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168575; cv=none; b=k5DLxdYc8XShxJ2jE+ROa0w0o/R5atDoBSCgMylUSH/CwOwdNSIGQljTaYUDrDvBf+9pEk2NpWn4gteZWWvApnyoPeRQrKOghVU34Hf2kMX0+peJYFAbbWNOfgYc5H8gBfIBGk8FGNMkpPs3Y8d4oWVHnmreVhIf0uwAlKXpjto= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1714168575; c=relaxed/simple; bh=1YuqOdwvzMl0EVMwj7Gm8Bkf0PIGwIDvNOLZbiF4ves=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=V8ChcwBaW04CijjA9hM7VjDDbTE07hA+PSoRaE4KuYqIBGXjIgEAwKkXmY1rb/BUnOH6Q3yzWGs8zE1iB74VlREzhabtEIXWb3SO5ZeEPmagg1fBSDUy6Oo7pxUKCi1ghS/4+RMnLiv2ZczGg2kBz5jDSdJ7vbI4o7lqXOUSnxE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UUOOKv4S; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UUOOKv4S" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-1eab16dcfd8so22467735ad.0 for ; Fri, 26 Apr 2024 14:56:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1714168574; x=1714773374; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=6dURvlKO6Os+021+tFsKCrIur6UAEiS03EpW3sWHq+k=; b=UUOOKv4S7yL/XTvgK15MTqksrzGGr+6QPWmhPe/6zcFmiu7r3WwX/D8fIXOHTktF2g ke0rP0pxOFDWLxpVM0YE+Lyo65XLwEGngBXPXL7HcWz60JQYU+U3kyRMk5oZGJoz6Np9 VOoZH4jFP3aJcTaxIdIdFcsA6q7Nn1eJ87PRwNTXykmDiJOKUwoqSych+a7viIBmwG82 0p0+xzIa6Gvjg2Qgs945BRvq14Uw0wdaioC60Ofqmx0RfS2EV9XLVthIJevY0+Qdsdyc RBDbuzmC0O3/A/KgZKR4EDpQXBF7wYVkR3+nSOjCiVq/M9q+uwQIfyYIPHBHJFFDVs4S bH5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714168574; x=1714773374; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=6dURvlKO6Os+021+tFsKCrIur6UAEiS03EpW3sWHq+k=; b=XDRffZqffFAl9HzCs9cB344kl2HXlNYuAXyGY5AaojXWc73r+zpDk/GijkFCQLZo9e LiU2mc5MTBx1PG5odkL8F6yN1cGzKYxAcaaiUNr2e9NEtZIz3eSY8+7cuOlMIvzYAriW jJBGOs6pNr+t9mYTAhN7aus+NRInpaiw3tTqgkYrc5vjeVZaaLvuwqHgLca2mfAnSK0W F3EiI3GMsWMD2T7fn5PDOuBttucRpVmSoEOjpQabMFgAbObu7GgdIp24zke9fmCvljhc ktQ8zq5lt80qpAAjb0oxUMIiOyQ46VuMy6cuU+xKZpkn3jcKvtc2aj/BEOSRTx1w/nNT H1iA== X-Gm-Message-State: AOJu0YwySWenCO+YTwBLcsRbVdbx0EgWTEf2FzNF3b5FKa34B1gdIN/6 ev1Rlw/bm9AnyCoFz0r5HX+sem6qp2aJ5ft0c7zlYWlexro6Jcg6gOkEsKBG X-Google-Smtp-Source: AGHT+IEz5/RaNH+Z/FJOeyZ6b81DJoolPWpmWQU0/fPuRCaD8nJoUzzBANa9gsNjECco7gnMtU2Syw== X-Received: by 2002:a17:902:fc85:b0:1e4:9ad5:7522 with SMTP id mf5-20020a170902fc8500b001e49ad57522mr935891plb.21.1714168573883; Fri, 26 Apr 2024 14:56:13 -0700 (PDT) Received: from lrumancik.svl.corp.google.com ([2620:15c:2a3:200:2b3a:c37d:d273:a588]) by smtp.gmail.com with ESMTPSA id b18-20020a170903229200b001eb2e6b14e0sm855772plh.126.2024.04.26.14.56.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Apr 2024 14:56:13 -0700 (PDT) From: Leah Rumancik To: linux-xfs@vger.kernel.org Cc: amir73il@gmail.com, chandan.babu@oracle.com, fred@cloudflare.com, mngyadam@amazon.com, Eric Sandeen , "Darrick J. Wong" , Chandan Babu R , Leah Rumancik Subject: [PATCH 6.1 CANDIDATE 24/24] xfs: short circuit xfs_growfs_data_private() if delta is zero Date: Fri, 26 Apr 2024 14:55:11 -0700 Message-ID: <20240426215512.2673806-25-leah.rumancik@gmail.com> X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog In-Reply-To: <20240426215512.2673806-1-leah.rumancik@gmail.com> References: <20240426215512.2673806-1-leah.rumancik@gmail.com> Precedence: bulk X-Mailing-List: linux-xfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Eric Sandeen [ Upstream commit 84712492e6dab803bf595fb8494d11098b74a652 ] Although xfs_growfs_data() doesn't call xfs_growfs_data_private() if in->newblocks == mp->m_sb.sb_dblocks, xfs_growfs_data_private() further massages the new block count so that we don't i.e. try to create a too-small new AG. This may lead to a delta of "0" in xfs_growfs_data_private(), so we end up in the shrink case and emit the EXPERIMENTAL warning even if we're not changing anything at all. Fix this by returning straightaway if the block delta is zero. (nb: in older kernels, the result of entering the shrink case with delta == 0 may actually let an -ENOSPC escape to userspace, which is confusing for users.) Fixes: fb2fc1720185 ("xfs: support shrinking unused space in the last AG") Signed-off-by: Eric Sandeen Reviewed-by: "Darrick J. Wong" Signed-off-by: Chandan Babu R Signed-off-by: Leah Rumancik --- fs/xfs/xfs_fsops.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c index 13851c0d640b..332da0d7b85c 100644 --- a/fs/xfs/xfs_fsops.c +++ b/fs/xfs/xfs_fsops.c @@ -129,6 +129,10 @@ xfs_growfs_data_private( if (delta < 0 && nagcount < 2) return -EINVAL; + /* No work to do */ + if (delta == 0) + return 0; + oagcount = mp->m_sb.sb_agcount; /* allocate the new per-ag structures */ if (nagcount > oagcount) {