From: Chao Yu <yuchao0@huawei.com> To: Jaegeuk Kim <jaegeuk@kernel.org> Cc: Chao Yu <chao@kernel.org>, <linux-f2fs-devel@lists.sourceforge.net>, <linux-kernel@vger.kernel.org> Subject: Re: [PATCH] f2fs: fix to avoid accessing uninitialized field of inode page in is_alive() Date: Mon, 9 Sep 2019 19:05:48 +0800 [thread overview] Message-ID: <94ea2431-d4da-f1bf-d949-3c36948aeeca@huawei.com> (raw) In-Reply-To: <20190909093355.GA27742@jaegeuk-macbookpro.roam.corp.google.com> On 2019/9/9 17:33, Jaegeuk Kim wrote: > On 09/09, Chao Yu wrote: >> On 2019/9/9 16:37, Jaegeuk Kim wrote: >>> On 09/09, Chao Yu wrote: >>>> On 2019/9/9 15:58, Chao Yu wrote: >>>>> On 2019/9/9 15:44, Jaegeuk Kim wrote: >>>>>> On 09/07, Chao Yu wrote: >>>>>>> On 2019-9-7 7:48, Jaegeuk Kim wrote: >>>>>>>> On 09/06, Chao Yu wrote: >>>>>>>>> If inode is newly created, inode page may not synchronize with inode cache, >>>>>>>>> so fields like .i_inline or .i_extra_isize could be wrong, in below call >>>>>>>>> path, we may access such wrong fields, result in failing to migrate valid >>>>>>>>> target block. >>>>>>>> >>>>>>>> If data is valid, how can we get new inode page? >>>>>> >>>>>> Let me rephrase the question. If inode is newly created, is this data block >>>>>> really valid to move in GC? >>>>> >>>>> I guess it's valid, let double check that. >>>> >>>> We can see inode page: >>>> >>>> - f2fs_create >>>> - f2fs_add_link >>>> - f2fs_add_dentry >>>> - f2fs_init_inode_metadata >>>> - f2fs_add_inline_entry >>>> - ipage = f2fs_new_inode_page >>>> - f2fs_put_page(ipage) <---- after this >>> >>> Can you print out how many block was assigned to this inode? >> >> Add log like this: >> >> if (!test_and_set_bit(segno, SIT_I(sbi)->invalid_segmap)) { >> if (is_inode) { >> for (i = 0; i < 923 - 50; i++) { >> __le32 *base = blkaddr_in_node(node); >> unsigned ofs = offset_in_addr(inode); >> >> printk("i:%u, addr:%x\n", i, >> le32_to_cpu(*(base + i))); >> } >> printk("i_inline: %u\n", inode->i_inline); >> } >> >> It shows: >> ... >> i:10, addr:e66a >> ... >> i:46, addr:e66c >> i:47, addr:e66d >> i:48, addr:e66e >> i:49, addr:e66f >> i:50, addr:e670 >> i:51, addr:e671 >> i:52, addr:e672 >> i:53, addr:e673 >> i:54, addr:e674 >> i:55, addr:e675 >> i:56, addr:e676 >> ... >> i:140, addr:2c35 <--- we want to migrate this block, however, without correct >> .i_inline and .i_extra_isize value, we can just find i_addr[i:140-6] = NULL_ADDR > > So, the theory is the block is indeed valid and the address was updated before > write_inode()? I guess so. :) Thanks, > >> i:141, addr:2c38 >> i:142, addr:2c39 >> i:143, addr:2c3b >> i:144, addr:2c3e >> i:145, addr:2c40 >> i:146, addr:2c44 >> i:147, addr:2c48 >> i:148, addr:2c4a >> i:149, addr:2c4c >> i:150, addr:2c4f >> i:151, addr:2c59 >> i:152, addr:2c5d >> ... >> i:188, addr:e677 >> i:189, addr:e678 >> i:190, addr:e679 >> i:191, addr:e67a >> i:192, addr:e67b >> i:193, addr:e67c >> i:194, addr:e67d >> i:195, addr:e67e >> i:196, addr:e67f >> i:197, addr:e680 >> i:198, addr:ffffffff >> i:199, addr:ffffffff >> i:200, addr:ffffffff >> i:201, addr:ffffffff >> i:202, addr:ffffffff >> i:203, addr:ffffffff >> i:204, addr:ffffffff >> i:205, addr:ffffffff >> i:206, addr:ffffffff >> i:207, addr:ffffffff >> i:208, addr:ffffffff >> i:209, addr:ffffffff >> i:210, addr:ffffffff >> i:211, addr:ffffffff >> i:212, addr:ffffffff >> i:213, addr:ffffffff >> i:214, addr:ffffffff >> i:215, addr:ffffffff >> i:216, addr:ffffffff >> i:217, addr:ffffffff >> i:218, addr:ffffffff >> i:219, addr:ffffffff >> i:220, addr:ffffffff >> i:221, addr:ffffffff >> i:222, addr:ffffffff >> i:223, addr:ffffffff >> i:224, addr:ffffffff >> i:225, addr:ffffffff >> i:226, addr:ffffffff >> i:227, addr:ffffffff >> i:228, addr:ffffffff >> i:229, addr:ffffffff >> i:230, addr:ffffffff >> i:231, addr:ffffffff >> i:232, addr:ffffffff >> i:233, addr:ffffffff >> i:234, addr:b032 >> i:235, addr:b033 >> i:236, addr:b034 >> i:237, addr:b035 >> i:238, addr:b036 >> i:239, addr:b038 >> ... >> i:283, addr:e681 >> ... >> i_inline: 0 >> >> F2FS-fs (zram1): summary nid: 360, ofs: 134, ver: 0 >> F2FS-fs (zram1): blkaddr 2c35 (blkaddr in node 0) <-blkaddr in node is NULL_ADDR >> F2FS-fs (zram1): expect: seg 14, ofs_in_seg: 53 >> F2FS-fs (zram1): real: seg 4294967295, ofs_in_seg: 0 >> F2FS-fs (zram1): ofs: 53, 0 >> F2FS-fs (zram1): node info ino:360, nid:360, nofs:0 >> F2FS-fs (zram1): ofs_in_addr: 0 >> F2FS-fs (zram1): end ======== >> >>> >>>> >>>>> >>>>>> >>>>>>> >>>>>>> is_alive() >>>>>>> { >>>>>>> ... >>>>>>> node_page = f2fs_get_node_page(sbi, nid); <--- inode page >>>>>> >>>>>> Aren't we seeing the below version warnings? >>>>>> >>>>>> if (sum->version != dni->version) { >>>>>> f2fs_warn(sbi, "%s: valid data with mismatched node version.", >>>>>> __func__); >>>>>> set_sbi_flag(sbi, SBI_NEED_FSCK); >>>>>> } >>>> >>>> The version of summary and dni are all zero. >>> >>> Then, this node was allocated and removed without being flushed. >>> >>>> >>>> summary nid: 613, ofs: 111, ver: 0 >>>> blkaddr 2436 (blkaddr in node 0) >>>> expect: seg 10, ofs_in_seg: 54 >>>> real: seg 4294967295, ofs_in_seg: 0 >>>> ofs: 54, 0 >>>> node info ino:613, nid:613, nofs:0 >>>> ofs_in_addr: 0 >>>> >>>> Thanks, >>>> >>>>>> >>>>>>> >>>>>>> source_blkaddr = datablock_addr(NULL, node_page, ofs_in_node); >>>>>> >>>>>> So, we're getting this? Does this incur infinite loop in GC? >>>>>> >>>>>> if (!test_and_set_bit(segno, SIT_I(sbi)->invalid_segmap)) { >>>>>> f2fs_err(sbi, "mismatched blkaddr %u (source_blkaddr %u) in seg %u\n", >>>>>> f2fs_bug_on(sbi, 1); >>>>>> } >>>>> >>>>> Yes, I only get this with generic/269, rather than "valid data with mismatched >>>>> node version.". >>> >>> Was this block moved as valid? In either way, is_alive() returns false, no? >>> How about checking i_blocks to detect the page is initialized in is_alive()? >>> >>>>> >>>>> With this patch, generic/269 won't panic again. >>>>> >>>>> Thanks, >>>>> >>>>>> >>>>>>> ... >>>>>>> } >>>>>>> >>>>>>> datablock_addr() >>>>>>> { >>>>>>> ... >>>>>>> base = offset_in_addr(&raw_node->i); <--- the base could be wrong here due to >>>>>>> accessing uninitialized .i_inline of raw_node->i. >>>>>>> ... >>>>>>> } >>>>>>> >>>>>>> Thanks, >>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>> - gc_data_segment >>>>>>>>> - is_alive >>>>>>>>> - datablock_addr >>>>>>>>> - offset_in_addr >>>>>>>>> >>>>>>>>> Fixes: 7a2af766af15 ("f2fs: enhance on-disk inode structure scalability") >>>>>>>>> Signed-off-by: Chao Yu <yuchao0@huawei.com> >>>>>>>>> --- >>>>>>>>> fs/f2fs/dir.c | 3 +++ >>>>>>>>> 1 file changed, 3 insertions(+) >>>>>>>>> >>>>>>>>> diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c >>>>>>>>> index 765f13354d3f..b1840852967e 100644 >>>>>>>>> --- a/fs/f2fs/dir.c >>>>>>>>> +++ b/fs/f2fs/dir.c >>>>>>>>> @@ -479,6 +479,9 @@ struct page *f2fs_init_inode_metadata(struct inode *inode, struct inode *dir, >>>>>>>>> if (IS_ERR(page)) >>>>>>>>> return page; >>>>>>>>> >>>>>>>>> + /* synchronize inode page's data from inode cache */ >>>>>>>>> + f2fs_update_inode(inode, page); >>>>>>>>> + >>>>>>>>> if (S_ISDIR(inode->i_mode)) { >>>>>>>>> /* in order to handle error case */ >>>>>>>>> get_page(page); >>>>>>>>> -- >>>>>>>>> 2.18.0.rc1 >>>>>> . >>>>>> >>> . >>> > . >
WARNING: multiple messages have this Message-ID (diff)
From: Chao Yu <yuchao0@huawei.com> To: Jaegeuk Kim <jaegeuk@kernel.org> Cc: linux-kernel@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net Subject: Re: [f2fs-dev] [PATCH] f2fs: fix to avoid accessing uninitialized field of inode page in is_alive() Date: Mon, 9 Sep 2019 19:05:48 +0800 [thread overview] Message-ID: <94ea2431-d4da-f1bf-d949-3c36948aeeca@huawei.com> (raw) In-Reply-To: <20190909093355.GA27742@jaegeuk-macbookpro.roam.corp.google.com> On 2019/9/9 17:33, Jaegeuk Kim wrote: > On 09/09, Chao Yu wrote: >> On 2019/9/9 16:37, Jaegeuk Kim wrote: >>> On 09/09, Chao Yu wrote: >>>> On 2019/9/9 15:58, Chao Yu wrote: >>>>> On 2019/9/9 15:44, Jaegeuk Kim wrote: >>>>>> On 09/07, Chao Yu wrote: >>>>>>> On 2019-9-7 7:48, Jaegeuk Kim wrote: >>>>>>>> On 09/06, Chao Yu wrote: >>>>>>>>> If inode is newly created, inode page may not synchronize with inode cache, >>>>>>>>> so fields like .i_inline or .i_extra_isize could be wrong, in below call >>>>>>>>> path, we may access such wrong fields, result in failing to migrate valid >>>>>>>>> target block. >>>>>>>> >>>>>>>> If data is valid, how can we get new inode page? >>>>>> >>>>>> Let me rephrase the question. If inode is newly created, is this data block >>>>>> really valid to move in GC? >>>>> >>>>> I guess it's valid, let double check that. >>>> >>>> We can see inode page: >>>> >>>> - f2fs_create >>>> - f2fs_add_link >>>> - f2fs_add_dentry >>>> - f2fs_init_inode_metadata >>>> - f2fs_add_inline_entry >>>> - ipage = f2fs_new_inode_page >>>> - f2fs_put_page(ipage) <---- after this >>> >>> Can you print out how many block was assigned to this inode? >> >> Add log like this: >> >> if (!test_and_set_bit(segno, SIT_I(sbi)->invalid_segmap)) { >> if (is_inode) { >> for (i = 0; i < 923 - 50; i++) { >> __le32 *base = blkaddr_in_node(node); >> unsigned ofs = offset_in_addr(inode); >> >> printk("i:%u, addr:%x\n", i, >> le32_to_cpu(*(base + i))); >> } >> printk("i_inline: %u\n", inode->i_inline); >> } >> >> It shows: >> ... >> i:10, addr:e66a >> ... >> i:46, addr:e66c >> i:47, addr:e66d >> i:48, addr:e66e >> i:49, addr:e66f >> i:50, addr:e670 >> i:51, addr:e671 >> i:52, addr:e672 >> i:53, addr:e673 >> i:54, addr:e674 >> i:55, addr:e675 >> i:56, addr:e676 >> ... >> i:140, addr:2c35 <--- we want to migrate this block, however, without correct >> .i_inline and .i_extra_isize value, we can just find i_addr[i:140-6] = NULL_ADDR > > So, the theory is the block is indeed valid and the address was updated before > write_inode()? I guess so. :) Thanks, > >> i:141, addr:2c38 >> i:142, addr:2c39 >> i:143, addr:2c3b >> i:144, addr:2c3e >> i:145, addr:2c40 >> i:146, addr:2c44 >> i:147, addr:2c48 >> i:148, addr:2c4a >> i:149, addr:2c4c >> i:150, addr:2c4f >> i:151, addr:2c59 >> i:152, addr:2c5d >> ... >> i:188, addr:e677 >> i:189, addr:e678 >> i:190, addr:e679 >> i:191, addr:e67a >> i:192, addr:e67b >> i:193, addr:e67c >> i:194, addr:e67d >> i:195, addr:e67e >> i:196, addr:e67f >> i:197, addr:e680 >> i:198, addr:ffffffff >> i:199, addr:ffffffff >> i:200, addr:ffffffff >> i:201, addr:ffffffff >> i:202, addr:ffffffff >> i:203, addr:ffffffff >> i:204, addr:ffffffff >> i:205, addr:ffffffff >> i:206, addr:ffffffff >> i:207, addr:ffffffff >> i:208, addr:ffffffff >> i:209, addr:ffffffff >> i:210, addr:ffffffff >> i:211, addr:ffffffff >> i:212, addr:ffffffff >> i:213, addr:ffffffff >> i:214, addr:ffffffff >> i:215, addr:ffffffff >> i:216, addr:ffffffff >> i:217, addr:ffffffff >> i:218, addr:ffffffff >> i:219, addr:ffffffff >> i:220, addr:ffffffff >> i:221, addr:ffffffff >> i:222, addr:ffffffff >> i:223, addr:ffffffff >> i:224, addr:ffffffff >> i:225, addr:ffffffff >> i:226, addr:ffffffff >> i:227, addr:ffffffff >> i:228, addr:ffffffff >> i:229, addr:ffffffff >> i:230, addr:ffffffff >> i:231, addr:ffffffff >> i:232, addr:ffffffff >> i:233, addr:ffffffff >> i:234, addr:b032 >> i:235, addr:b033 >> i:236, addr:b034 >> i:237, addr:b035 >> i:238, addr:b036 >> i:239, addr:b038 >> ... >> i:283, addr:e681 >> ... >> i_inline: 0 >> >> F2FS-fs (zram1): summary nid: 360, ofs: 134, ver: 0 >> F2FS-fs (zram1): blkaddr 2c35 (blkaddr in node 0) <-blkaddr in node is NULL_ADDR >> F2FS-fs (zram1): expect: seg 14, ofs_in_seg: 53 >> F2FS-fs (zram1): real: seg 4294967295, ofs_in_seg: 0 >> F2FS-fs (zram1): ofs: 53, 0 >> F2FS-fs (zram1): node info ino:360, nid:360, nofs:0 >> F2FS-fs (zram1): ofs_in_addr: 0 >> F2FS-fs (zram1): end ======== >> >>> >>>> >>>>> >>>>>> >>>>>>> >>>>>>> is_alive() >>>>>>> { >>>>>>> ... >>>>>>> node_page = f2fs_get_node_page(sbi, nid); <--- inode page >>>>>> >>>>>> Aren't we seeing the below version warnings? >>>>>> >>>>>> if (sum->version != dni->version) { >>>>>> f2fs_warn(sbi, "%s: valid data with mismatched node version.", >>>>>> __func__); >>>>>> set_sbi_flag(sbi, SBI_NEED_FSCK); >>>>>> } >>>> >>>> The version of summary and dni are all zero. >>> >>> Then, this node was allocated and removed without being flushed. >>> >>>> >>>> summary nid: 613, ofs: 111, ver: 0 >>>> blkaddr 2436 (blkaddr in node 0) >>>> expect: seg 10, ofs_in_seg: 54 >>>> real: seg 4294967295, ofs_in_seg: 0 >>>> ofs: 54, 0 >>>> node info ino:613, nid:613, nofs:0 >>>> ofs_in_addr: 0 >>>> >>>> Thanks, >>>> >>>>>> >>>>>>> >>>>>>> source_blkaddr = datablock_addr(NULL, node_page, ofs_in_node); >>>>>> >>>>>> So, we're getting this? Does this incur infinite loop in GC? >>>>>> >>>>>> if (!test_and_set_bit(segno, SIT_I(sbi)->invalid_segmap)) { >>>>>> f2fs_err(sbi, "mismatched blkaddr %u (source_blkaddr %u) in seg %u\n", >>>>>> f2fs_bug_on(sbi, 1); >>>>>> } >>>>> >>>>> Yes, I only get this with generic/269, rather than "valid data with mismatched >>>>> node version.". >>> >>> Was this block moved as valid? In either way, is_alive() returns false, no? >>> How about checking i_blocks to detect the page is initialized in is_alive()? >>> >>>>> >>>>> With this patch, generic/269 won't panic again. >>>>> >>>>> Thanks, >>>>> >>>>>> >>>>>>> ... >>>>>>> } >>>>>>> >>>>>>> datablock_addr() >>>>>>> { >>>>>>> ... >>>>>>> base = offset_in_addr(&raw_node->i); <--- the base could be wrong here due to >>>>>>> accessing uninitialized .i_inline of raw_node->i. >>>>>>> ... >>>>>>> } >>>>>>> >>>>>>> Thanks, >>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>> - gc_data_segment >>>>>>>>> - is_alive >>>>>>>>> - datablock_addr >>>>>>>>> - offset_in_addr >>>>>>>>> >>>>>>>>> Fixes: 7a2af766af15 ("f2fs: enhance on-disk inode structure scalability") >>>>>>>>> Signed-off-by: Chao Yu <yuchao0@huawei.com> >>>>>>>>> --- >>>>>>>>> fs/f2fs/dir.c | 3 +++ >>>>>>>>> 1 file changed, 3 insertions(+) >>>>>>>>> >>>>>>>>> diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c >>>>>>>>> index 765f13354d3f..b1840852967e 100644 >>>>>>>>> --- a/fs/f2fs/dir.c >>>>>>>>> +++ b/fs/f2fs/dir.c >>>>>>>>> @@ -479,6 +479,9 @@ struct page *f2fs_init_inode_metadata(struct inode *inode, struct inode *dir, >>>>>>>>> if (IS_ERR(page)) >>>>>>>>> return page; >>>>>>>>> >>>>>>>>> + /* synchronize inode page's data from inode cache */ >>>>>>>>> + f2fs_update_inode(inode, page); >>>>>>>>> + >>>>>>>>> if (S_ISDIR(inode->i_mode)) { >>>>>>>>> /* in order to handle error case */ >>>>>>>>> get_page(page); >>>>>>>>> -- >>>>>>>>> 2.18.0.rc1 >>>>>> . >>>>>> >>> . >>> > . > _______________________________________________ Linux-f2fs-devel mailing list Linux-f2fs-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
next prev parent reply other threads:[~2019-09-09 11:06 UTC|newest] Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-09-06 10:54 [PATCH] f2fs: fix to avoid accessing uninitialized field of inode page in is_alive() Chao Yu 2019-09-06 10:54 ` [f2fs-dev] " Chao Yu 2019-09-06 23:48 ` Jaegeuk Kim 2019-09-06 23:48 ` [f2fs-dev] " Jaegeuk Kim 2019-09-07 1:23 ` Chao Yu 2019-09-07 1:23 ` [f2fs-dev] " Chao Yu 2019-09-09 7:44 ` Jaegeuk Kim 2019-09-09 7:44 ` [f2fs-dev] " Jaegeuk Kim 2019-09-09 7:58 ` Chao Yu 2019-09-09 7:58 ` [f2fs-dev] " Chao Yu 2019-09-09 8:16 ` Chao Yu 2019-09-09 8:16 ` [f2fs-dev] " Chao Yu 2019-09-09 8:37 ` Jaegeuk Kim 2019-09-09 8:37 ` [f2fs-dev] " Jaegeuk Kim 2019-09-09 9:18 ` Chao Yu 2019-09-09 9:18 ` [f2fs-dev] " Chao Yu 2019-09-09 9:33 ` Jaegeuk Kim 2019-09-09 9:33 ` [f2fs-dev] " Jaegeuk Kim 2019-09-09 11:05 ` Chao Yu [this message] 2019-09-09 11:05 ` Chao Yu 2019-09-09 14:37 ` Jaegeuk Kim 2019-09-09 14:37 ` [f2fs-dev] " Jaegeuk Kim 2019-09-10 0:59 ` Chao Yu 2019-09-10 0:59 ` [f2fs-dev] " Chao Yu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=94ea2431-d4da-f1bf-d949-3c36948aeeca@huawei.com \ --to=yuchao0@huawei.com \ --cc=chao@kernel.org \ --cc=jaegeuk@kernel.org \ --cc=linux-f2fs-devel@lists.sourceforge.net \ --cc=linux-kernel@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.