Thread (117 messages) 117 messages, 8 authors, 2021-05-30

Re: [Patch v2 41/42] btrfs: fix the use-after-free bug in writeback subpage helper

From: Qu Wenruo <hidden>
Date: 2021-05-26 05:58:36


On 2021/5/26 下午1:29, Ritesh Harjani wrote:
On 21/05/25 06:32PM, Ritesh Harjani wrote:
quoted
On 21/05/25 07:41PM, Qu Wenruo wrote:
quoted

On 2021/5/25 下午6:20, Ritesh Harjani wrote:
[...]
quoted
quoted
quoted
- 9d57e61bf723 ("of/pci: Add IORESOURCE_MEM_64 to resource flags for 64-
     bit memory addresses")
     Will screw up at least my ARM board, which is using device tree for
     its PCIE node.
     Have to revert it.

- 764c7c9a464b ("btrfs: zoned: fix parallel compressed writes")
     Will screw up compressed write with striped RAID profile.
     Fix sent to the mail list:

https://patchwork.kernel.org/project/linux-btrfs/patch/20210525055243.85166-1-wqu@suse.com/


- Known btrfs mkfs bug
     Fix sent to the mail list:

https://patchwork.kernel.org/project/linux-btrfs/patch/20210517095516.129287-1-wqu@suse.com/


- btrfs/215 false alert
     Fix sent to the mail list:

https://patchwork.kernel.org/project/linux-btrfs/patch/20210517092922.119788-1-wqu@suse.com/
Please wait for while.

I just checked my latest result, the branch doesn't pass my local test
for subpage case.

I'll fix it first, sorry for the problem.
Ok, yes (it's failing for me in some test case).
Sure, will until your confirmation.
Got the reason. The patch "btrfs: allow submit_extent_page() to do bio
split for subpage" got a conflict when got rebased, due to zone code change.

The conflict wasn't big, but to be extra safe, I manually re-craft the
patch from the scratch, to find out what's wrong.

During that re-crafting, I forgot to delete two lines, prevent
btrfs_add_bio_page() from splitting bio properly, and submit empty bio,
thus causing an ASSERT() in submit_extent_page().

The bug can be reliably reproduced by btrfs/060, thus that one can be a
quick test to make sure the problem is gone.

BTW, for older subpage branch, the latest one without problem is at HEAD
2af4eb21b234c6ddbc37568529219d33038f7f7c, which I also tested on a
Power8 VM, it passes "-g auto" with only 18 known failures.

I believe it's now safe to re-test.
Thanks. I will give your latest subpage github branch a run then :)
Hi Qu,

I am still running the tests, but I observed this warning msg with btrfs/062.
Sorry, did I miss any patches to take?
Nope, I believe it's a new bug.

Either caused by the new code base or something else.

Please go ahead, this random warning doesn't seem to be that frequent, I 
have only observed it om btrfs/062, btrfs/072, btrfs/074.

Of course, if you have stable way to reproduce, it would help a lot of 
locate the problem.

Thanks,
Qu
I am testing your below branch
https://github.com/adam900710/linux/commits/subpage

btrfs/062
<...>
[ 1466.928035] BTRFS info (device vdc): has skinny extents
[ 1466.928103] BTRFS warning (device vdc): read-write for sector size 4096 with page size 65536 is experimental
[ 1466.936997] BTRFS info (device vdc): checking UUID tree
[ 1467.295249] BTRFS info (device vdc): balance: start -d -m -s
[ 1469.177204] ------------[ cut here ]------------
[ 1469.177402] WARNING: CPU: 5 PID: 319 at fs/btrfs/extent_map.c:306 unpin_extent_cache+0x78/0x140
[ 1469.177597] Modules linked in:
[ 1469.177655] CPU: 5 PID: 319 Comm: kworker/u16:5 Not tainted 5.13.0-rc2-00382-g1d349b93923f #34
[ 1469.177773] Workqueue: btrfs-endio-write btrfs_work_helper
[ 1469.177845] NIP:  c000000000a334c8 LR: c000000000a334b4 CTR: 0000000000000000
[ 1469.177943] REGS: c00000000d7e7750 TRAP: 0700   Not tainted  (5.13.0-rc2-00382-g1d349b93923f)
[ 1469.178054] MSR:  800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 84002448  XER: 20000000
[ 1469.178187] CFAR: c000000000a3303c IRQMASK: 0
[ 1469.178187] GPR00: c000000000a334b4 c00000000d7e79f0 c000000001c5dc00 c00000002b15f968
[ 1469.178187] GPR04: 0000000000070000 000000000001a000 0000000000000001 0000000000000001
[ 1469.178187] GPR08: 0000000000000002 0000000000000002 0000000000000001 ffffffffffffffff
[ 1469.178187] GPR12: 0000000000002200 c00000003ffe8a00 c000000000213568 c00000000a1f1240
[ 1469.178187] GPR16: c00000002b934000 c000000026f4a2c0 c00000000d7e7ac8 0000000000000001
[ 1469.178187] GPR20: 0000000000000000 c000000026f49ec8 0000000000000024 c000000022bda000
[ 1469.178187] GPR24: 0000000000000020 000000000001a000 c000000026f49e08 000000000000000d
[ 1469.178187] GPR28: 000000000007b000 c000000026f49e88 c000000026f49e68 c00000002b15f968
[ 1469.179053] NIP [c000000000a334c8] unpin_extent_cache+0x78/0x140
[ 1469.179137] LR [c000000000a334b4] unpin_extent_cache+0x64/0x140
[ 1469.179220] Call Trace:
[ 1469.179254] [c00000000d7e79f0] [c000000000a334b4] unpin_extent_cache+0x64/0x140 (unreliable)
[ 1469.179371] [c00000000d7e7a50] [c000000000a23d28] btrfs_finish_ordered_io+0x528/0xbd0
[ 1469.179473] [c00000000d7e7ba0] [c000000000a64360] btrfs_work_helper+0x260/0x8e0
[ 1469.179572] [c00000000d7e7c40] [c000000000206954] process_one_work+0x434/0x7d0
[ 1469.179687] [c00000000d7e7d10] [c000000000206ff4] worker_thread+0x304/0x570
[ 1469.179771] [c00000000d7e7da0] [c00000000021371c] kthread+0x1bc/0x1d0
[ 1469.179855] [c00000000d7e7e10] [c00000000000d6ec] ret_from_kernel_thread+0x5c/0x70
[ 1469.179956] Instruction dump:
[ 1469.180007] 4887a5d1 60000000 7f84e378 7fc3f378 38c00001 e8a10028 4bfff949 7c7f1b79
[ 1469.180114] 41820010 e89f0018 7fa4e000 419e000c <0fe00000> 41820088 fb7f0060 395f0068
[ 1469.180222] irq event stamp: 1458062
[ 1469.180271] hardirqs last  enabled at (1458061): [<c0000000012ad654>] _raw_spin_unlock_irq+0x44/0x80
[ 1469.180411] hardirqs last disabled at (1458062): [<c0000000012a1cfc>] __schedule+0x31c/0xce0
[ 1469.180524] softirqs last  enabled at (1457908): [<c0000000012ae818>] __do_softirq+0x5e8/0x680
[ 1469.180661] softirqs last disabled at (1457899): [<c0000000001dc56c>] irq_exit+0x15c/0x1e0
[ 1469.180760] ---[ end trace f937e1c0f5a3b8fa ]---
[ 1469.537482] BTRFS info (device vdc): relocating block group 298844160 flags data|raid1
[ 1470.963925] BTRFS info (device vdc): found 343 extents, stage: move data extents
[ 1471.332749] BTRFS info (device vdc): found 341 extents, stage: update data pointers
[ 1471.656937] BTRFS info (device vdc): relocating block group 30408704 flags metadata|raid1
[ 1472.015159] BTRFS info (device vdc): found 84 extents, stage: move data extents
[ 1472.355357] BTRFS info (device vdc): relocating block group 22020096 flags system|raid1
[ 1472.689631] BTRFS info (device vdc): found 1 extents, stage: move data extents
[ 1473.052977] BTRFS info (device vdc): balance: ended with status: 0


-ritesh
  
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help