From patchwork Sat Feb 3 16:16:45 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ryusuke Konishi X-Patchwork-Id: 196336 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:9bc1:b0:106:209c:c626 with SMTP id op1csp1094182dyc; Sat, 3 Feb 2024 08:17:44 -0800 (PST) X-Google-Smtp-Source: AGHT+IG5Mgp58VoXc+f70m2Yk7JU0bgM++azva8XmFjaiMEeSSWdm68sAiXhLyeEjT58iZxopXv0 X-Received: by 2002:a05:6a20:d80d:b0:19e:6461:ba3a with SMTP id iv13-20020a056a20d80d00b0019e6461ba3amr257132pzb.61.1706977064404; Sat, 03 Feb 2024 08:17:44 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1706977064; cv=pass; d=google.com; s=arc-20160816; b=vDeqBzkHwhwTNZLXDLS2RQvleKqxV2Q1A7NmVor9SfrCzna9mVHp1+LvKu9SljTWRI Pm2RJB0275ldGc/wN0cEZVM+q9bF/CWtPCZnh1ea4PM2batnIKAsWN6Fvy38j/hu4nk+ urH3eIpTUOWZ5fcL+4KJK479Bn7D8MEVAWSMz+k83pajOXCIs2lCRpcFpxT0EXxoi5YA Ut4rwc/u/w+I977GoR1Jn1f/FJFInZF8bRQoTJz3iT4tMYJU/ajDRA8Bi0TiNIeh1WCE GK7VLUaALpVVLVBxkjaO1lJGaPhSXJiC6YVsrdVODmV9T3IclFIWfq2xnWigk+Fuhk/K 3Feg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=kkKSBEd57oTuNT42X1XreOYTPrUWtWe7ns5GZwL0900=; fh=kNQrmiv8lKuEjqnZPfhx3iWzHAzn1s7v8Las6tipRs8=; b=WOymEcDJlV9yeKNyGlmM9QlhA6CTM2PZMbAy94SvOgWxkEMr9BHSs4QNknrUHs6+Mt N6/aCFOLwfD3Ve76pOSzee42qIuI4aaBGU2RxRsQ2UAWEtt+Gt9AV0syPmPKqhf+dFlt znzmLxu56bTgki9giRwFHhZEwl4b3KMJyuqKYWSKvxjEBmNtelkhmIMzPwO56sKNhO5r /slqa8IWBNvi1Kaq0AV8uX3njQH209ZI6riQXkDTjZhpLccy6gMl9BD1g6C/nK6Z7Ehp mRhwkDx6SIZhcNCxeV9UkXSl3W57lAoOpN9DsdvR8kAGNNJNs4Lh6Kny2z37UTSHXITP GeKQ==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=S7jV1sBs; arc=pass (i=1 spf=pass spfdomain=gmail.com dkim=pass dkdomain=gmail.com dmarc=pass fromdomain=gmail.com); spf=pass (google.com: domain of linux-kernel+bounces-51178-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51178-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com X-Forwarded-Encrypted: i=1; AJvYcCW3PdLPq1k8DHawRq5yFk9SY7AOpF8WSOZfSOgEdrUR0zs9KvVcgJ5pAlE8t/HP6C0B81u/c+QNNI0qJxOJFpEMQ4c4dA== Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id g3-20020aa79dc3000000b006e02eb7faf6si670563pfq.250.2024.02.03.08.17.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Feb 2024 08:17:44 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-51178-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=S7jV1sBs; arc=pass (i=1 spf=pass spfdomain=gmail.com dkim=pass dkdomain=gmail.com dmarc=pass fromdomain=gmail.com); spf=pass (google.com: domain of linux-kernel+bounces-51178-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51178-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id E0AE4284F8A for ; Sat, 3 Feb 2024 16:17:29 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id B18F55F85C; Sat, 3 Feb 2024 16:17:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="S7jV1sBs" Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F8105F561; Sat, 3 Feb 2024 16:17:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706977029; cv=none; b=jHEvtgniNqTczrmoAmxL4jrRwWaGn7WzbO3Ilr1aZq1iIhKAXC5fbo1ArSbd3YJgLHsqGI/6PZjrFpmjwOJ7yTqnLnT58FBIpaqzvT5z9JWSGcdxCNqoPEJ6XH4uQTIANYB4b/MgXjPmWV2xsCbFBDZhcwIAkBjuxj3uUXEvHO8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706977029; c=relaxed/simple; bh=2GPOc2PZ2fg/zlvgyDEmTDV/NI/x0BA9gFkuOhJfAhw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=fWzrPQ5ZpIdeH8BAL5QraDctUs8ebzYSGQ097OzQA7HKwzqUtMoiJXrxldvig1N8x5ExdZFRY++ikKjMtNjNZ178DJ9+fXZQGNp3uZ+3SB5OXQBN3+owUtVopTRdd5P1ZF7h25CqUhbysQkNNPkd/djk/pujHndnIoP9FiHxuk8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=S7jV1sBs; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-1d76671e5a4so24458355ad.0; Sat, 03 Feb 2024 08:17:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1706977027; x=1707581827; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=kkKSBEd57oTuNT42X1XreOYTPrUWtWe7ns5GZwL0900=; b=S7jV1sBs7Mcm7rqfwHOJP6a0cwTGEyInPG5WsPEt2HGJrno0qvX7tGGdtjYz+hn0lb YYM2gMcxV++t3vaAs4PcaXfehuiPWyV3/jwfAynQSJpEMbDbER8VdvAsOoPep4Bz0Kr+ Vcd+vwfzFejN0tsQJcZnGaBqFXB4xg8GrEFB4aqeKoo5Cpts4dJVKZpJXqOIsYzqY+fV D+crHNFqJ0w92g0+OmjsT7gbrWCFOo1wBcOg9Iv98iVZoG6dKB9K9FD6ZYWbDCxpVmTA 8hf6C4B5xpkIbT28tFcWySR/d+QspiMqfskk1SPui2QJ9hrkLAo2OOr/BOWn5ie7FH7p npsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706977027; x=1707581827; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=kkKSBEd57oTuNT42X1XreOYTPrUWtWe7ns5GZwL0900=; b=ILUlmya94cY0qU9mQM297EkrtdajrnrrJ9ylmWG/H6hHBSmYK5LJG/oUVBdx61ixsk gE2BK38bV5t8wWwrjkCFehBvEVUgkgj0XoKx+doUPLreYhlaZmkZEMVLjYnLIujyarwa 4/WW//4eXF3EXsUnSzC7LRWBZPAQfddquQ+qe2wLcIiXT3BcB5gUUi4dpVFsr4ZYhHAs 2E/pvUPUQHVnyOnzKDju42quFyN/JWaLKzijxCRUhulcvXO59mBlgoc1RkUyEfi4HSMe CU3HDUWycqyzIHyGNWSHYbxAr4mITkQPSFbAx/1HS9ew3hfE3q0KQr9iMDjZG4kcVzMt 82jg== X-Gm-Message-State: AOJu0YwHXfv3ctOB4nfhgYJYT0Lmq4Er6fm26c33wVnSs/T0K03JZiiq r6QobvAQH2x6DZ09heKeHrQOAt8BQED/AZFnFSNZQIny0QtT/NxG X-Received: by 2002:a17:902:e807:b0:1d7:83e4:a19 with SMTP id u7-20020a170902e80700b001d783e40a19mr15438382plg.33.1706977027362; Sat, 03 Feb 2024 08:17:07 -0800 (PST) X-Forwarded-Encrypted: i=0; AJvYcCULw3SkPAaFjzvA6Q65uEQ8raXUpBhJ0EnZPV9zLFUX5bKx2X9NDKnGsY0NTXcjz3SXf4C6HzWXEBLvbdnCr58EpB3Bub36vNbCmhWz2xdVQz3f3UMt88wMpKGoR8+WqjUwJKJrBPb8mGZSxK3p89Fkyg75Fk1E9qc270suqMUMhj/qcW64nctsNHeggY3Fqm1X3jxKGD6QdgBxqueu6IYMb5Akvg== Received: from carrot.. (i223-218-113-167.s42.a014.ap.plala.or.jp. [223.218.113.167]) by smtp.gmail.com with ESMTPSA id jh2-20020a170903328200b001d94546686esm3465551plb.28.2024.02.03.08.17.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Feb 2024 08:17:05 -0800 (PST) From: Ryusuke Konishi To: Andrew Morton Cc: linux-nilfs@vger.kernel.org, syzbot , syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org Subject: [PATCH] nilfs2: fix potential bug in end_buffer_async_write Date: Sun, 4 Feb 2024 01:16:45 +0900 Message-Id: <20240203161645.4992-1-konishi.ryusuke@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <00000000000019a97c05fd42f8c8@google.com> References: <00000000000019a97c05fd42f8c8@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1789895182188047166 X-GMAIL-MSGID: 1789895182188047166 According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async_write flag and cause a BUG_ON failure when using nilfs2. Nilfs2 itself does not use end_buffer_async_write(). But, the async_write flag is now used as a marker by commit 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") as a means of resolving double list insertion of dirty blocks in nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the resulting crash. This modification is safe as long as it is used for file data and b-tree node blocks where the page caches are independent. However, it was irrelevant and redundant to also introduce async_write for segment summary and super root blocks that share buffers with the backing device. This led to the possibility that the BUG_ON check in end_buffer_async_write would fail as described above, if independent writebacks of the backing device occurred in parallel. The use of async_write for segment summary buffers has already been removed in a previous change. Fix this issue by removing the manipulation of the async_write flag for the remaining super root block buffer. Signed-off-by: Ryusuke Konishi Reported-by: syzbot+5c04210f7c7f897c1e7f@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/00000000000019a97c05fd42f8c8@google.com Fixes: 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") Cc: --- Andrew, please apply this as a bugfix. This fixes a kernel bug issue reported by syzbot. This may conflict with the merged folio conversion series when backporting it to stable trees. I would like to send a separate request to the stable team in that case. Thanks, Ryusuke Konishi fs/nilfs2/segment.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 2590a0860eab..2bfb08052d39 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1703,7 +1703,6 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) list_for_each_entry(bh, &segbuf->sb_payload_buffers, b_assoc_buffers) { - set_buffer_async_write(bh); if (bh == segbuf->sb_super_root) { if (bh->b_folio != bd_folio) { folio_lock(bd_folio); @@ -1714,6 +1713,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci) } break; } + set_buffer_async_write(bh); if (bh->b_folio != fs_folio) { nilfs_begin_folio_io(fs_folio); fs_folio = bh->b_folio; @@ -1800,7 +1800,6 @@ static void nilfs_abort_logs(struct list_head *logs, int err) list_for_each_entry(bh, &segbuf->sb_payload_buffers, b_assoc_buffers) { - clear_buffer_async_write(bh); if (bh == segbuf->sb_super_root) { clear_buffer_uptodate(bh); if (bh->b_folio != bd_folio) { @@ -1809,6 +1808,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err) } break; } + clear_buffer_async_write(bh); if (bh->b_folio != fs_folio) { nilfs_end_folio_io(fs_folio, err); fs_folio = bh->b_folio; @@ -1896,8 +1896,9 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci) BIT(BH_Delay) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Redirected)); - set_mask_bits(&bh->b_state, clear_bits, set_bits); if (bh == segbuf->sb_super_root) { + set_buffer_uptodate(bh); + clear_buffer_dirty(bh); if (bh->b_folio != bd_folio) { folio_end_writeback(bd_folio); bd_folio = bh->b_folio; @@ -1905,6 +1906,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci) update_sr = true; break; } + set_mask_bits(&bh->b_state, clear_bits, set_bits); if (bh->b_folio != fs_folio) { nilfs_end_folio_io(fs_folio, 0); fs_folio = bh->b_folio;