Commit 723e3866 authored by Nikolay Borisov's avatar Nikolay Borisov Committed by Greg Kroah-Hartman

btrfs: Ensure replaced device doesn't have pending chunk allocation

commit debd1c06 upstream.

Recent FITRIM work, namely bbbf7243 ("btrfs: combine device update
operations during transaction commit") combined the way certain
operations are recoded in a transaction. As a result an ASSERT was added
in dev_replace_finish to ensure the new code works correctly.
Unfortunately I got reports that it's possible to trigger the assert,
meaning that during a device replace it's possible to have an unfinished
chunk allocation on the source device.

This is supposed to be prevented by the fact that a transaction is
committed before finishing the replace oepration and alter acquiring the
chunk mutex. This is not sufficient since by the time the transaction is
committed and the chunk mutex acquired it's possible to allocate a chunk
depending on the workload being executed on the replaced device. This
bug has been present ever since device replace was introduced but there
was never code which checks for it.

The correct way to fix is to ensure that there is no pending device
modification operation when the chunk mutex is acquire and if there is
repeat transaction commit. Unfortunately it's not possible to just
exclude the source device from btrfs_fs_devices::dev_alloc_list since
this causes ENOSPC to be hit in transaction commit.

Fixing that in another way would need to add special cases to handle the
last writes and forbid new ones. The looped transaction fix is more
obvious, and can be easily backported. The runtime of dev-replace is
long so there's no noticeable delay caused by that.
Reported-by: default avatarDavid Sterba <dsterba@suse.com>
Fixes: 391cd9df ("Btrfs: fix unprotected alloc list insertion during the finishing procedure of replace")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: default avatarNikolay Borisov <nborisov@suse.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d4ad26ed
...@@ -603,17 +603,25 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, ...@@ -603,17 +603,25 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
} }
btrfs_wait_ordered_roots(fs_info, U64_MAX, 0, (u64)-1); btrfs_wait_ordered_roots(fs_info, U64_MAX, 0, (u64)-1);
trans = btrfs_start_transaction(root, 0); while (1) {
if (IS_ERR(trans)) { trans = btrfs_start_transaction(root, 0);
mutex_unlock(&dev_replace->lock_finishing_cancel_unmount); if (IS_ERR(trans)) {
return PTR_ERR(trans); mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
return PTR_ERR(trans);
}
ret = btrfs_commit_transaction(trans);
WARN_ON(ret);
/* keep away write_all_supers() during the finishing procedure */
mutex_lock(&fs_info->fs_devices->device_list_mutex);
mutex_lock(&fs_info->chunk_mutex);
if (src_device->has_pending_chunks) {
mutex_unlock(&root->fs_info->chunk_mutex);
mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
} else {
break;
}
} }
ret = btrfs_commit_transaction(trans);
WARN_ON(ret);
/* keep away write_all_supers() during the finishing procedure */
mutex_lock(&fs_info->fs_devices->device_list_mutex);
mutex_lock(&fs_info->chunk_mutex);
down_write(&dev_replace->rwsem); down_write(&dev_replace->rwsem);
dev_replace->replace_state = dev_replace->replace_state =
scrub_ret ? BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED scrub_ret ? BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED
......
...@@ -5222,9 +5222,11 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, ...@@ -5222,9 +5222,11 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
if (ret) if (ret)
goto error_del_extent; goto error_del_extent;
for (i = 0; i < map->num_stripes; i++) for (i = 0; i < map->num_stripes; i++) {
btrfs_device_set_bytes_used(map->stripes[i].dev, btrfs_device_set_bytes_used(map->stripes[i].dev,
map->stripes[i].dev->bytes_used + stripe_size); map->stripes[i].dev->bytes_used + stripe_size);
map->stripes[i].dev->has_pending_chunks = true;
}
atomic64_sub(stripe_size * map->num_stripes, &info->free_chunk_space); atomic64_sub(stripe_size * map->num_stripes, &info->free_chunk_space);
...@@ -7716,6 +7718,7 @@ void btrfs_update_commit_device_bytes_used(struct btrfs_transaction *trans) ...@@ -7716,6 +7718,7 @@ void btrfs_update_commit_device_bytes_used(struct btrfs_transaction *trans)
for (i = 0; i < map->num_stripes; i++) { for (i = 0; i < map->num_stripes; i++) {
dev = map->stripes[i].dev; dev = map->stripes[i].dev;
dev->commit_bytes_used = dev->bytes_used; dev->commit_bytes_used = dev->bytes_used;
dev->has_pending_chunks = false;
} }
} }
mutex_unlock(&fs_info->chunk_mutex); mutex_unlock(&fs_info->chunk_mutex);
......
...@@ -54,6 +54,11 @@ struct btrfs_device { ...@@ -54,6 +54,11 @@ struct btrfs_device {
spinlock_t io_lock ____cacheline_aligned; spinlock_t io_lock ____cacheline_aligned;
int running_pending; int running_pending;
/* When true means this device has pending chunk alloc in
* current transaction. Protected by chunk_mutex.
*/
bool has_pending_chunks;
/* regular prio bios */ /* regular prio bios */
struct btrfs_pending_bios pending_bios; struct btrfs_pending_bios pending_bios;
/* sync bios */ /* sync bios */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment