[PATCH v2 1/2] btrfs: Add a test for leaking root crash at unmount time

[PATCH v2 1/2] btrfs: Add a test for leaking root crash at unmount time

[Qu Wenruo]

Test if canceled balance could lead to root leakage.
If the kernel has CONFIG_BTRFS_DEBUG compiled, unmount time root leakge
check would detect it, and cause NULL pointer dereference as the pages
of the leaked root are already freed.

The fix is titled "btrfs: relocation: Fix reloc root leakage and the NULL
 pointer reference caused by the leakage".

Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
---
Changelog:
v2:
- Fix gramma and typos
- Use _run_btrfs_balance_start()
---
 tests/btrfs/212     | 85 +++++++++++++++++++++++++++++++++++++++++++++
 tests/btrfs/212.out |  2 ++
 tests/btrfs/group   |  1 +
 3 files changed, 88 insertions(+)
 create mode 100755 tests/btrfs/212
 create mode 100644 tests/btrfs/212.out

diff --git a/tests/btrfs/212 b/tests/btrfs/212
new file mode 100755
index 00000000..d2a7b0d7
--- /dev/null
+++ b/tests/btrfs/212
@@ -0,0 +1,85 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (C) 2020 SUSE Linux Products GmbH. All Rights Reserved.
+#
+# FS QA Test 212
+#
+# Test if unmounting a fs with balance canceled can lead to crash.
+# This needs CONFIG_BTRFS_DEBUG compiled, which adds extra unmount time self-test
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+_cleanup()
+{
+	cd /
+	rm -f $tmp.*
+	kill $balance_pid &> /dev/null
+	kill $cancel_pid &> /dev/null
+	"$KILLALL_PROG" -q $FSSTRESS_PROG &> /dev/null
+	$BTRFS_UTIL_PROG balance cancel $SCRATCH_MNT &> /dev/null
+	wait
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+
+# remove previous $seqres.full before test
+rm -f $seqres.full
+
+# real QA test starts here
+
+# Modify as appropriate.
+_supported_fs btrfs 
+_supported_os Linux
+_require_scratch
+_require_command "$KILLALL_PROG" killall
+
+_scratch_mkfs >> $seqres.full
+_scratch_mount
+
+runtime=15
+
+balance_workload()
+{
+	trap "wait; exit" SIGTERM
+	while true; do
+		_run_btrfs_balance_start &> /dev/null
+	done
+}
+
+cancel_workload()
+{
+	trap "wait; exit" SIGTERM
+	while true; do
+		$BTRFS_UTIL_PROG balance cancel $SCRATCH_MNT &> /dev/null
+		sleep 2
+	done
+}
+
+$FSSTRESS_PROG -d $SCRATCH_MNT -w -n 100000  >> $seqres.full 2>/dev/null &
+balance_workload &
+balance_pid=$!
+
+cancel_workload &
+cancel_pid=$!
+
+sleep $runtime
+
+kill $balance_pid
+kill $cancel_pid
+"$KILLALL_PROG" -q $FSSTRESS_PROG &> /dev/null
+$BTRFS_UTIL_PROG balance cancel $SCRATCH_MNT &> /dev/null
+wait
+
+echo "Silence is golden"
+# success, all done
+status=0
+exit
diff --git a/tests/btrfs/212.out b/tests/btrfs/212.out
new file mode 100644
index 00000000..32d11390
--- /dev/null
+++ b/tests/btrfs/212.out
@@ -0,0 +1,2 @@
+QA output created by 212
+Silence is golden
diff --git a/tests/btrfs/group b/tests/btrfs/group
index 66b1beac..8d65bddd 100644
--- a/tests/btrfs/group
+++ b/tests/btrfs/group
@@ -214,3 +214,4 @@
 209 auto quick log
 210 auto quick qgroup snapshot
 211 auto quick log prealloc
+212 auto balance dangerous
-- 
2.26.2

[PATCH 2/2] btrfs: Add a test for dead looping balance after balance cancel

[Qu Wenruo]

Test if canceling a running balance can cause later balance to dead
loop.

The fix is titled "btrfs: relocation: Clear the DEAD_RELOC_TREE bit for
 orphan roots to prevent runaway balance".

Signed-off-by: Qu Wenruo <wqu@suse.com>
---
Changelog:
v2:
- Remove lsof debug output
v3:
- Remove ps debug output
v4:
- Use $XFS_IO_PROG directly to avoid wrapped dd command
  This allows us to kill the writer and wait it correctly, other than
  killing the bash process running the wrapper function.
- Fix typos
- Use _run_btrfs_balance_start() wrapper
---
 tests/btrfs/213     | 65 +++++++++++++++++++++++++++++++++++++++++++++
 tests/btrfs/213.out |  2 ++
 tests/btrfs/group   |  1 +
 3 files changed, 68 insertions(+)
 create mode 100755 tests/btrfs/213
 create mode 100644 tests/btrfs/213.out

diff --git a/tests/btrfs/213 b/tests/btrfs/213
new file mode 100755
index 00000000..a3a2afe0
--- /dev/null
+++ b/tests/btrfs/213
@@ -0,0 +1,65 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (C) 2020 SUSE Linux Products GmbH. All Rights Reserved.
+#
+# FS QA Test 213
+#
+# Test if canceling a running balance can lead to dead looping balance
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+_cleanup()
+{
+	cd /
+	rm -f $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+
+# remove previous $seqres.full before test
+rm -f $seqres.full
+
+# Modify as appropriate.
+_supported_fs btrfs
+_supported_os Linux
+_require_scratch
+_require_xfs_io_command pwrite -D
+
+_scratch_mkfs >> $seqres.full
+_scratch_mount
+
+runtime=4
+
+# Create enough IO so that we need around $runtime seconds to relocate it.
+#
+# Here we don't want any wrapper, as we want full control of the process.
+$XFS_IO_PROG -f -c "pwrite -D -b 1M 0 1024T" "$SCRATCH_MNT/file" &> /dev/null &
+write_pid=$!
+sleep $runtime
+kill $write_pid
+wait $write_pid
+
+# Now balance should take at least $runtime seconds, we can cancel it at
+# $runtime/2 to ensure a success cancel.
+_run_btrfs_balance_start -d --bg "$SCRATCH_MNT"
+sleep $(($runtime / 2))
+$BTRFS_UTIL_PROG balance cancel "$SCRATCH_MNT"
+
+# Now check if we can finish relocating metadata, which should finish very
+# quickly.
+$BTRFS_UTIL_PROG balance start -m "$SCRATCH_MNT" >> $seqres.full
+
+echo "Silence is golden"
+
+# success, all done
+status=0
+exit
diff --git a/tests/btrfs/213.out b/tests/btrfs/213.out
new file mode 100644
index 00000000..bd8f2430
--- /dev/null
+++ b/tests/btrfs/213.out
@@ -0,0 +1,2 @@
+QA output created by 213
+Silence is golden
diff --git a/tests/btrfs/group b/tests/btrfs/group
index 8d65bddd..59e8ecce 100644
--- a/tests/btrfs/group
+++ b/tests/btrfs/group
@@ -215,3 +215,4 @@
 210 auto quick qgroup snapshot
 211 auto quick log prealloc
 212 auto balance dangerous
+213 auto quick balance dangerous
-- 
2.26.2

Re: [PATCH 2/2] btrfs: Add a test for dead looping balance after balance cancel

[Filipe Manana]

On Wed, May 20, 2020 at 12:47 PM Qu Wenruo <wqu@suse.com> wrote:
>
> Test if canceling a running balance can cause later balance to dead
> loop.
>
> The fix is titled "btrfs: relocation: Clear the DEAD_RELOC_TREE bit for
>  orphan roots to prevent runaway balance".
>
> Signed-off-by: Qu Wenruo <wqu@suse.com>
> ---
> Changelog:
> v2:
> - Remove lsof debug output
> v3:
> - Remove ps debug output
> v4:
> - Use $XFS_IO_PROG directly to avoid wrapped dd command
>   This allows us to kill the writer and wait it correctly, other than
>   killing the bash process running the wrapper function.
> - Fix typos
> - Use _run_btrfs_balance_start() wrapper
> ---
>  tests/btrfs/213     | 65 +++++++++++++++++++++++++++++++++++++++++++++
>  tests/btrfs/213.out |  2 ++
>  tests/btrfs/group   |  1 +
>  3 files changed, 68 insertions(+)
>  create mode 100755 tests/btrfs/213
>  create mode 100644 tests/btrfs/213.out
>
> diff --git a/tests/btrfs/213 b/tests/btrfs/213
> new file mode 100755
> index 00000000..a3a2afe0
> --- /dev/null
> +++ b/tests/btrfs/213
> @@ -0,0 +1,65 @@
> +#! /bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +# Copyright (C) 2020 SUSE Linux Products GmbH. All Rights Reserved.
> +#
> +# FS QA Test 213
> +#
> +# Test if canceling a running balance can lead to dead looping balance
> +#
> +seq=`basename $0`
> +seqres=$RESULT_DIR/$seq
> +echo "QA output created by $seq"
> +
> +here=`pwd`
> +tmp=/tmp/$$
> +status=1       # failure is the default!
> +trap "_cleanup; exit \$status" 0 1 2 3 15
> +
> +_cleanup()
> +{
> +       cd /
> +       rm -f $tmp.*
> +}
> +
> +# get standard environment, filters and checks
> +. ./common/rc
> +. ./common/filter
> +
> +# remove previous $seqres.full before test
> +rm -f $seqres.full
> +
> +# Modify as appropriate.
> +_supported_fs btrfs
> +_supported_os Linux
> +_require_scratch
> +_require_xfs_io_command pwrite -D
> +
> +_scratch_mkfs >> $seqres.full
> +_scratch_mount
> +
> +runtime=4
> +
> +# Create enough IO so that we need around $runtime seconds to relocate it.
> +#
> +# Here we don't want any wrapper, as we want full control of the process.
> +$XFS_IO_PROG -f -c "pwrite -D -b 1M 0 1024T" "$SCRATCH_MNT/file" &> /dev/null &
> +write_pid=$!
> +sleep $runtime

Probably you forgot, but as I said before, we should make sure the
xfs_io process is killed in _cleanup() too, in case we abort the test
while it is in that sleep above.

With that added,

Reviewed-by: Filipe Manana <fdmanana@suse.com>

Thanks.

> +kill $write_pid
> +wait $write_pid
> +
> +# Now balance should take at least $runtime seconds, we can cancel it at
> +# $runtime/2 to ensure a success cancel.
> +_run_btrfs_balance_start -d --bg "$SCRATCH_MNT"
> +sleep $(($runtime / 2))
> +$BTRFS_UTIL_PROG balance cancel "$SCRATCH_MNT"
> +
> +# Now check if we can finish relocating metadata, which should finish very
> +# quickly.
> +$BTRFS_UTIL_PROG balance start -m "$SCRATCH_MNT" >> $seqres.full
> +
> +echo "Silence is golden"
> +
> +# success, all done
> +status=0
> +exit
> diff --git a/tests/btrfs/213.out b/tests/btrfs/213.out
> new file mode 100644
> index 00000000..bd8f2430
> --- /dev/null
> +++ b/tests/btrfs/213.out
> @@ -0,0 +1,2 @@
> +QA output created by 213
> +Silence is golden
> diff --git a/tests/btrfs/group b/tests/btrfs/group
> index 8d65bddd..59e8ecce 100644
> --- a/tests/btrfs/group
> +++ b/tests/btrfs/group
> @@ -215,3 +215,4 @@
>  210 auto quick qgroup snapshot
>  211 auto quick log prealloc
>  212 auto balance dangerous
> +213 auto quick balance dangerous
> --
> 2.26.2
>


-- 
Filipe David Manana,

“Whether you think you can, or you think you can't — you're right.”