1. 03 Mar, 2020 4 commits
    • Christoph Hellwig's avatar
      xfs: ensure that the inode uid/gid match values match the icdinode ones · 3d8f2821
      Christoph Hellwig authored
      Instead of only synchronizing the uid/gid values in xfs_setup_inode,
      ensure that they always match to prepare for removing the icdinode
      fields.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      3d8f2821
    • Darrick J. Wong's avatar
      xfs: improve error message when we can't allocate memory for xfs_buf · 93baa55a
      Darrick J. Wong authored
      If xfs_buf_get_map can't allocate enough memory for the buffer it's
      trying to create, it'll cough up an error about not being able to
      allocate "pagesn".  That's not particularly helpful (and if we're really
      out of memory the message is very spammy) so change the message to tell
      us how many pages were actually requested, and ratelimit it too.
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      93baa55a
    • Zheng Bin's avatar
      xfs: add agf freeblocks verify in xfs_agf_verify · d0c7feaf
      Zheng Bin authored
      We recently used fuzz(hydra) to test XFS and automatically generate
      tmp.img(XFS v5 format, but some metadata is wrong)
      
      xfs_repair information(just one AG):
      agf_freeblks 0, counted 3224 in ag 0
      agf_longest 536874136, counted 3224 in ag 0
      sb_fdblocks 613, counted 3228
      
      Test as follows:
      mount tmp.img tmpdir
      cp file1M tmpdir
      sync
      
      In 4.19-stable, sync will stuck, the reason is:
      xfs_mountfs
        xfs_check_summary_counts
          if ((!xfs_sb_version_haslazysbcount(&mp->m_sb) ||
             XFS_LAST_UNMOUNT_WAS_CLEAN(mp)) &&
             !xfs_fs_has_sickness(mp, XFS_SICK_FS_COUNTERS))
      	return 0;  -->just return, incore sb_fdblocks still be 613
          xfs_initialize_perag_data
      
      cp file1M tmpdir -->ok(write file to pagecache)
      sync -->stuck(write pagecache to disk)
      xfs_map_blocks
        xfs_iomap_write_allocate
          while (count_fsb != 0) {
            nimaps = 0;
            while (nimaps == 0) { --> endless loop
               nimaps = 1;
               xfs_bmapi_write(..., &nimaps) --> nimaps becomes 0 again
      xfs_bmapi_write
        xfs_bmap_alloc
          xfs_bmap_btalloc
            xfs_alloc_vextent
              xfs_alloc_fix_freelist
                xfs_alloc_space_available -->fail(agf_freeblks is 0)
      
      In linux-next, sync not stuck, cause commit c2b31643 ("xfs:
      use the latest extent at writeback delalloc conversion time") remove
      the above while, dmesg is as follows:
      [   55.250114] XFS (loop0): page discard on page ffffea0008bc7380, inode 0x1b0c, offset 0.
      
      Users do not know why this page is discard, the better soultion is:
      1. Like xfs_repair, make sure sb_fdblocks is equal to counted
      (xfs_initialize_perag_data did this, who is not called at this mount)
      2. Add agf verify, if fail, will tell users to repair
      
      This patch use the second soultion.
      Signed-off-by: default avatarZheng Bin <zhengbin13@huawei.com>
      Signed-off-by: default avatarRen Xudong <renxudong1@huawei.com>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      d0c7feaf
    • Brian Foster's avatar
      xfs: fix iclog release error check race with shutdown · 6b789c33
      Brian Foster authored
      Prior to commit df732b29 ("xfs: call xlog_state_release_iclog with
      l_icloglock held"), xlog_state_release_iclog() always performed a
      locked check of the iclog error state before proceeding into the
      sync state processing code. As of this commit, part of
      xlog_state_release_iclog() was open-coded into
      xfs_log_release_iclog() and as a result the locked error state check
      was lost.
      
      The lockless check still exists, but this doesn't account for the
      possibility of a race with a shutdown being performed by another
      task causing the iclog state to change while the original task waits
      on ->l_icloglock. This has reproduced very rarely via generic/475
      and manifests as an assert failure in __xlog_state_release_iclog()
      due to an unexpected iclog state.
      
      Restore the locked error state check in xlog_state_release_iclog()
      to ensure that an iclog state update via shutdown doesn't race with
      the iclog release state processing code.
      
      Fixes: df732b29 ("xfs: call xlog_state_release_iclog with l_icloglock held")
      Reported-by: default avatarZorro Lang <zlang@redhat.com>
      Signed-off-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
      6b789c33
  2. 01 Mar, 2020 5 commits
  3. 29 Feb, 2020 4 commits
    • Dan Carpenter's avatar
      ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() · 37b0b6b8
      Dan Carpenter authored
      If sbi->s_flex_groups_allocated is zero and the first allocation fails
      then this code will crash.  The problem is that "i--" will set "i" to
      -1 but when we compare "i >= sbi->s_flex_groups_allocated" then the -1
      is type promoted to unsigned and becomes UINT_MAX.  Since UINT_MAX
      is more than zero, the condition is true so we call kvfree(new_groups[-1]).
      The loop will carry on freeing invalid memory until it crashes.
      
      Fixes: 7c990728 ("ext4: fix potential race between s_flex_groups online resizing and access")
      Reviewed-by: default avatarSuraj Jitindar Singh <surajjs@amazon.com>
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Cc: stable@kernel.org
      Link: https://lore.kernel.org/r/20200228092142.7irbc44yaz3by7nb@kili.mountainSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      37b0b6b8
    • Wolfram Sang's avatar
      macintosh: therm_windtunnel: fix regression when instantiating devices · 38b17afb
      Wolfram Sang authored
      Removing attach_adapter from this driver caused a regression for at
      least some machines. Those machines had the sensors described in their
      DT, too, so they didn't need manual creation of the sensor devices. The
      old code worked, though, because manual creation came first. Creation of
      DT devices then failed later and caused error logs, but the sensors
      worked nonetheless because of the manually created devices.
      
      When removing attach_adaper, manual creation now comes later and loses
      the race. The sensor devices were already registered via DT, yet with
      another binding, so the driver could not be bound to it.
      
      This fix refactors the code to remove the race and only manually creates
      devices if there are no DT nodes present. Also, the DT binding is updated
      to match both, the DT and manually created devices. Because we don't
      know which device creation will be used at runtime, the code to start
      the kthread is moved to do_probe() which will be called by both methods.
      
      Fixes: 3e7bed52 ("macintosh: therm_windtunnel: drop using attach_adapter")
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=201723Reported-by: default avatarErhard Furtner <erhard_f@mailbox.org>
      Tested-by: default avatarErhard Furtner <erhard_f@mailbox.org>
      Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      Cc: stable@kernel.org # v4.19+
      38b17afb
    • Qian Cai's avatar
      jbd2: fix data races at struct journal_head · 6c5d9112
      Qian Cai authored
      journal_head::b_transaction and journal_head::b_next_transaction could
      be accessed concurrently as noticed by KCSAN,
      
       LTP: starting fsync04
       /dev/zero: Can't open blockdev
       EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem
       EXT4-fs (loop0): mounted filesystem with ordered data mode. Opts: (null)
       ==================================================================
       BUG: KCSAN: data-race in __jbd2_journal_refile_buffer [jbd2] / jbd2_write_access_granted [jbd2]
      
       write to 0xffff99f9b1bd0e30 of 8 bytes by task 25721 on cpu 70:
        __jbd2_journal_refile_buffer+0xdd/0x210 [jbd2]
        __jbd2_journal_refile_buffer at fs/jbd2/transaction.c:2569
        jbd2_journal_commit_transaction+0x2d15/0x3f20 [jbd2]
        (inlined by) jbd2_journal_commit_transaction at fs/jbd2/commit.c:1034
        kjournald2+0x13b/0x450 [jbd2]
        kthread+0x1cd/0x1f0
        ret_from_fork+0x27/0x50
      
       read to 0xffff99f9b1bd0e30 of 8 bytes by task 25724 on cpu 68:
        jbd2_write_access_granted+0x1b2/0x250 [jbd2]
        jbd2_write_access_granted at fs/jbd2/transaction.c:1155
        jbd2_journal_get_write_access+0x2c/0x60 [jbd2]
        __ext4_journal_get_write_access+0x50/0x90 [ext4]
        ext4_mb_mark_diskspace_used+0x158/0x620 [ext4]
        ext4_mb_new_blocks+0x54f/0xca0 [ext4]
        ext4_ind_map_blocks+0xc79/0x1b40 [ext4]
        ext4_map_blocks+0x3b4/0x950 [ext4]
        _ext4_get_block+0xfc/0x270 [ext4]
        ext4_get_block+0x3b/0x50 [ext4]
        __block_write_begin_int+0x22e/0xae0
        __block_write_begin+0x39/0x50
        ext4_write_begin+0x388/0xb50 [ext4]
        generic_perform_write+0x15d/0x290
        ext4_buffered_write_iter+0x11f/0x210 [ext4]
        ext4_file_write_iter+0xce/0x9e0 [ext4]
        new_sync_write+0x29c/0x3b0
        __vfs_write+0x92/0xa0
        vfs_write+0x103/0x260
        ksys_write+0x9d/0x130
        __x64_sys_write+0x4c/0x60
        do_syscall_64+0x91/0xb05
        entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
       5 locks held by fsync04/25724:
        #0: ffff99f9911093f8 (sb_writers#13){.+.+}, at: vfs_write+0x21c/0x260
        #1: ffff99f9db4c0348 (&sb->s_type->i_mutex_key#15){+.+.}, at: ext4_buffered_write_iter+0x65/0x210 [ext4]
        #2: ffff99f5e7dfcf58 (jbd2_handle){++++}, at: start_this_handle+0x1c1/0x9d0 [jbd2]
        #3: ffff99f9db4c0168 (&ei->i_data_sem){++++}, at: ext4_map_blocks+0x176/0x950 [ext4]
        #4: ffffffff99086b40 (rcu_read_lock){....}, at: jbd2_write_access_granted+0x4e/0x250 [jbd2]
       irq event stamp: 1407125
       hardirqs last  enabled at (1407125): [<ffffffff980da9b7>] __find_get_block+0x107/0x790
       hardirqs last disabled at (1407124): [<ffffffff980da8f9>] __find_get_block+0x49/0x790
       softirqs last  enabled at (1405528): [<ffffffff98a0034c>] __do_softirq+0x34c/0x57c
       softirqs last disabled at (1405521): [<ffffffff97cc67a2>] irq_exit+0xa2/0xc0
      
       Reported by Kernel Concurrency Sanitizer on:
       CPU: 68 PID: 25724 Comm: fsync04 Tainted: G L 5.6.0-rc2-next-20200221+ #7
       Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 07/10/2019
      
      The plain reads are outside of jh->b_state_lock critical section which result
      in data races. Fix them by adding pairs of READ|WRITE_ONCE().
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Signed-off-by: default avatarQian Cai <cai@lca.pw>
      Link: https://lore.kernel.org/r/20200222043111.2227-1-cai@lca.pwSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      6c5d9112
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 7557c1b3
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Four small fixes.
      
        Three are in drivers for fairly obvious bugs. The fourth is a set of
        regressions introduced by the compat_ioctl changes because some of the
        compat updates wrongly replaced .ioctl instead of .compat_ioctl"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: compat_ioctl: cdrom: Replace .ioctl with .compat_ioctl in four appropriate places
        scsi: zfcp: fix wrong data and display format of SFP+ temperature
        scsi: sd_sbc: Fix sd_zbc_report_zones()
        scsi: libfc: free response frame from GPN_ID
      7557c1b3
  4. 28 Feb, 2020 21 commits
  5. 27 Feb, 2020 6 commits