12 Feb, 2019

1 commit


06 Dec, 2018

1 commit

  • commit 41e817bca3acd3980efe5dd7d28af0e6f4ab9247 upstream.

    commit e259221763a40403d5bb232209998e8c45804ab8 ("fs: simplify the
    generic_write_sync prototype") reworked callers of generic_write_sync(),
    and ended up dropping the error return for the directio path. Prior to
    that commit, in dio_complete(), an error would be bubbled up the stack,
    but after that commit, errors passed on to dio_complete were eaten up.

    This was reported on the list earlier, and a fix was proposed in
    https://lore.kernel.org/lkml/20160921141539.GA17898@infradead.org/, but
    never followed up with. We recently hit this bug in our testing where
    fencing io errors, which were previously erroring out with EIO, were
    being returned as success operations after this commit.

    The fix proposed on the list earlier was a little short -- it would have
    still called generic_write_sync() in case `ret` already contained an
    error. This fix ensures generic_write_sync() is only called when there's
    no pending error in the write. Additionally, transferred is replaced
    with ret to bring this code in line with other callers.

    Fixes: e259221763a4 ("fs: simplify the generic_write_sync prototype")
    Reported-by: Ravi Nankani
    Signed-off-by: Maximilian Heyne
    Reviewed-by: Christoph Hellwig
    CC: Torsten Mehlan
    CC: Uwe Dannowski
    CC: Amit Shah
    CC: David Woodhouse
    CC: stable@vger.kernel.org
    Signed-off-by: Jens Axboe
    Signed-off-by: Greg Kroah-Hartman

    Maximilian Heyne
     

09 Mar, 2018

1 commit

  • commit d9c10e5b8863cfb6886d1640386455075c6e979d upstream.

    Commit e864f39569f4 "fs: add RWF_DSYNC aand RWF_SYNC" added additional
    way for direct IO to become synchronous and thus trigger fsync from the
    IO completion handler. Then commit 9830f4be159b "fs: Use RWF_* flags for
    AIO operations" allowed these flags to be set for AIO as well. However
    that commit forgot to update the condition checking whether the IO
    completion handling should be defered to a workqueue and thus AIO DIO
    with RWF_[D]SYNC set will call fsync() from IRQ context resulting in
    sleep in atomic.

    Fix the problem by checking directly iocb flags (the same way as it is
    done in dio_complete()) instead of checking all conditions that could
    lead to IO being synchronous.

    CC: Christoph Hellwig
    CC: Goldwyn Rodrigues
    CC: stable@vger.kernel.org
    Reported-by: Mark Rutland
    Tested-by: Mark Rutland
    Fixes: 9830f4be159b29399d107bffb99e0132bc5aedd4
    Signed-off-by: Jan Kara
    Signed-off-by: Jens Axboe
    Signed-off-by: Greg Kroah-Hartman

    Jan Kara
     

19 Oct, 2017

2 commits

  • Pull xfs fixes from Darrick Wong:

    - fix some more CONFIG_XFS_RT related build problems

    - fix data loss when writeback at eof races eofblocks gc and loses

    - invalidate page cache after fs finishes a dio write

    - remove dirty page state when invalidating pages so releasepage does
    the right thing when handed a dirty page

    * tag 'xfs-4.14-fixes-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
    xfs: move two more RT specific functions into CONFIG_XFS_RT
    xfs: trim writepage mapping to within eof
    fs: invalidate page cache after end_io() in dio completion
    xfs: cancel dirty pages on invalidation

    Linus Torvalds
     
  • Pull block fixes from Jens Axboe:
    "Three small fixes:

    - A fix for skd, it was using kfree() to free a structure allocate
    with kmem_cache_alloc().

    - Stable fix for nbd, fixing a regression using the normal ioctl
    based tools.

    - Fix for a previous fix in this series, that fixed up
    inconsistencies between buffered and direct IO"

    * 'for-linus' of git://git.kernel.dk/linux-block:
    fs: Avoid invalidation in interrupt context in dio_complete()
    nbd: don't set the device size until we're connected
    skd: Use kmem_cache_free

    Linus Torvalds
     

17 Oct, 2017

2 commits

  • Currently we try to defer completion of async DIO to the process context
    in case there are any mapped pages associated with the inode so that we
    can invalidate the pages when the IO completes. However the check is racy
    and the pages can be mapped afterwards. If this happens we might end up
    calling invalidate_inode_pages2_range() in dio_complete() in interrupt
    context which could sleep. This can be reproduced by generic/451.

    Fix this by passing the information whether we can or can't invalidate
    to the dio_complete(). Thanks Eryu Guan for reporting this and Jan Kara
    for suggesting a fix.

    Fixes: 332391a9935d ("fs: Fix page cache inconsistency when mixing buffered and AIO DIO")
    Reported-by: Eryu Guan
    Reviewed-by: Jan Kara
    Tested-by: Eryu Guan
    Signed-off-by: Lukas Czerner
    Signed-off-by: Jens Axboe

    Lukas Czerner
     
  • Commit 332391a9935d ("fs: Fix page cache inconsistency when mixing
    buffered and AIO DIO") moved page cache invalidation from
    iomap_dio_rw() to iomap_dio_complete() for iomap based direct write
    path, but before the dio->end_io() call, and it re-introdued the bug
    fixed by commit c771c14baa33 ("iomap: invalidate page caches should
    be after iomap_dio_complete() in direct write").

    I found this because fstests generic/418 started failing on XFS with
    v4.14-rc3 kernel, which is the regression test for this specific
    bug.

    So similarly, fix it by moving dio->end_io() (which does the
    unwritten extent conversion) before page cache invalidation, to make
    sure next buffer read reads the final real allocations not unwritten
    extents. I also add some comments about why should end_io() go first
    in case we get it wrong again in the future.

    Note that, there's no such problem in the non-iomap based direct
    write path, because we didn't remove the page cache invalidation
    after the ->direct_IO() in generic_file_direct_write() call, but I
    decided to fix dio_complete() too so we don't leave a landmine
    there, also be consistent with iomap_dio_complete().

    Fixes: 332391a9935d ("fs: Fix page cache inconsistency when mixing buffered and AIO DIO")
    Signed-off-by: Eryu Guan
    Reviewed-by: Darrick J. Wong
    Signed-off-by: Darrick J. Wong
    Reviewed-by: Jan Kara
    Reviewed-by: Lukas Czerner

    Eryu Guan
     

11 Oct, 2017

1 commit

  • In the code added to function submit_page_section by commit b1058b981,
    sdio->bio can currently be NULL when calling dio_bio_submit. This then
    leads to a NULL pointer access in dio_bio_submit, so check for a NULL
    bio in submit_page_section before trying to submit it instead.

    Fixes xfstest generic/250 on gfs2.

    Cc: stable@vger.kernel.org # v3.10+
    Signed-off-by: Andreas Gruenbacher
    Reviewed-by: Jan Kara
    Signed-off-by: Al Viro

    Andreas Gruenbacher
     

25 Sep, 2017

1 commit

  • Currently when mixing buffered reads and asynchronous direct writes it
    is possible to end up with the situation where we have stale data in the
    page cache while the new data is already written to disk. This is
    permanent until the affected pages are flushed away. Despite the fact
    that mixing buffered and direct IO is ill-advised it does pose a thread
    for a data integrity, is unexpected and should be fixed.

    Fix this by deferring completion of asynchronous direct writes to a
    process context in the case that there are mapped pages to be found in
    the inode. Later before the completion in dio_complete() invalidate
    the pages in question. This ensures that after the completion the pages
    in the written area are either unmapped, or populated with up-to-date
    data. Also do the same for the iomap case which uses
    iomap_dio_complete() instead.

    This has a side effect of deferring the completion to a process context
    for every AIO DIO that happens on inode that has pages mapped. However
    since the consensus is that this is ill-advised practice the performance
    implication should not be a problem.

    This was based on proposal from Jeff Moyer, thanks!

    Reviewed-by: Jan Kara
    Reviewed-by: Darrick J. Wong
    Reviewed-by: Jeff Moyer
    Signed-off-by: Lukas Czerner
    Signed-off-by: Jens Axboe

    Lukas Czerner
     

24 Aug, 2017

1 commit

  • This way we don't need a block_device structure to submit I/O. The
    block_device has different life time rules from the gendisk and
    request_queue and is usually only available when the block device node
    is open. Other callers need to explicitly create one (e.g. the lightnvm
    passthrough code, or the new nvme multipathing code).

    For the actual I/O path all that we need is the gendisk, which exists
    once per block device. But given that the block layer also does
    partition remapping we additionally need a partition index, which is
    used for said remapping in generic_make_request.

    Note that all the block drivers generally want request_queue or
    sometimes the gendisk, so this removes a layer of indirection all
    over the stack.

    Signed-off-by: Christoph Hellwig
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     

28 Jun, 2017

1 commit


20 Jun, 2017

1 commit

  • A new bio operation flag REQ_NOWAIT is introduced to identify bio's
    orignating from iocb with IOCB_NOWAIT. This flag indicates
    to return immediately if a request cannot be made instead
    of retrying.

    Stacked devices such as md (the ones with make_request_fn hooks)
    currently are not supported because it may block for housekeeping.
    For example, an md can have a part of the device suspended.
    For this reason, only request based devices are supported.
    In the future, this feature will be expanded to stacked devices
    by teaching them how to handle the REQ_NOWAIT flags.

    Reviewed-by: Christoph Hellwig
    Reviewed-by: Jens Axboe
    Signed-off-by: Goldwyn Rodrigues
    Signed-off-by: Jens Axboe

    Goldwyn Rodrigues
     

09 Jun, 2017

3 commits


28 Feb, 2017

1 commit

  • Replace all 1 << inode->i_blkbits and (1 << inode->i_blkbits) in fs
    branch.

    This patch also fixes multiple checkpatch warnings: WARNING: Prefer
    'unsigned int' to bare use of 'unsigned'

    Thanks to Andrew Morton for suggesting more appropriate function instead
    of macro.

    [geliangtang@gmail.com: truncate: use i_blocksize()]
    Link: http://lkml.kernel.org/r/9c8b2cd83c8f5653805d43debde9fa8817e02fc4.1484895804.git.geliangtang@gmail.com
    Link: http://lkml.kernel.org/r/1481319905-10126-1-git-send-email-fabf@skynet.be
    Signed-off-by: Fabian Frederick
    Signed-off-by: Geliang Tang
    Cc: Alexander Viro
    Cc: Ross Zwisler
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Fabian Frederick
     

11 Jan, 2017

1 commit

  • The code currently uses sdio->blkbits to compute the number of blocks to
    be cleaned. However sdio->blkbits is derived from the logical block size
    of the underlying block device (Refer to the definition of
    do_blockdev_direct_IO()). Due to this, generic/299 test would rarely
    fail when executed on an ext4 filesystem with 64k as the block size and
    when using a virtio based disk (having 512 byte as the logical block
    size) inside a kvm guest.

    This commit fixes the bug by using inode->i_blkbits to compute the
    number of blocks to be cleaned.

    Signed-off-by: Chandan Rajendra
    Reviewed-by: Christoph Hellwig

    Fixed up by Jeff Moyer to only use/evaluate inode->i_blkbits once,
    to avoid issues with block size changes with IO in flight.

    Signed-off-by: Jens Axboe

    Chandan Rajendra
     

15 Dec, 2016

2 commits

  • Pull xfs updates from Dave Chinner:
    "There is quite a varied bunch of stuff in this update, and some of it
    you will have already merged through the ext4 tree which imported the
    dax-4.10-iomap-pmd topic branch from the XFS tree.

    There is also a new direct IO implementation that uses the iomap
    infrastructure. It's much simpler, faster, and has lower IO latency
    than the existing direct IO infrastructure.

    Summary:
    - DAX PMD faults via iomap infrastructure
    - Direct-io support in iomap infrastructure
    - removal of now-redundant XFS inode iolock, replaced with VFS
    i_rwsem
    - synchronisation with fixes and changes in userspace libxfs code
    - extent tree lookup helpers
    - lots of little corruption detection improvements to verifiers
    - optimised CRC calculations
    - faster buffer cache lookups
    - deprecation of barrier/nobarrier mount options - we always use
    REQ_FUA/REQ_FLUSH where appropriate for data integrity now
    - cleanups to speculative preallocation
    - miscellaneous minor bug fixes and cleanups"

    * tag 'xfs-for-linus-4.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs: (63 commits)
    xfs: nuke unused tracepoint definitions
    xfs: use GPF_NOFS when allocating btree cursors
    xfs: use xfs_vn_setattr_size to check on new size
    xfs: deprecate barrier/nobarrier mount option
    xfs: Always flush caches when integrity is required
    xfs: ignore leaf attr ichdr.count in verifier during log replay
    xfs: use rhashtable to track buffer cache
    xfs: optimise CRC updates
    xfs: make xfs btree stats less huge
    xfs: don't cap maximum dedupe request length
    xfs: don't allow di_size with high bit set
    xfs: error out if trying to add attrs and anextents > 0
    xfs: don't crash if reading a directory results in an unexpected hole
    xfs: complain if we don't get nextents bmap records
    xfs: check for bogus values in btree block headers
    xfs: forbid AG btrees with level == 0
    xfs: several xattr functions can be void
    xfs: handle cow fork in xfs_bmap_trace_exlist
    xfs: pass state not whichfork to trace_xfs_extlist
    xfs: Move AGI buffer type setting to xfs_read_agi
    ...

    Linus Torvalds
     
  • Pull fs meta data unmap optimization from Jens Axboe:
    "A series from Jan Kara, providing a more efficient way for unmapping
    meta data from in the buffer cache than doing it block-by-block.

    Provide a general helper that existing callers can use"

    * 'for-4.10/fs-unmap' of git://git.kernel.dk/linux-block:
    fs: Remove unmap_underlying_metadata
    fs: Add helper to clean bdev aliases under a bh and use it
    ext2: Use clean_bdev_aliases() instead of iteration
    ext4: Use clean_bdev_aliases() instead of iteration
    direct-io: Use clean_bdev_aliases() instead of handmade iteration
    fs: Provide function to unmap metadata for a range of blocks

    Linus Torvalds
     

30 Nov, 2016

1 commit


12 Nov, 2016

1 commit


05 Nov, 2016

1 commit


01 Nov, 2016

1 commit


04 Oct, 2016

1 commit


08 Jun, 2016

2 commits

  • This patch has the dio code use a REQ_OP for the op and rq_flag_bits
    for bi_rw flags. To set/get the op it uses the bio_set_op_attrs/bio_op
    accssors.

    It also begins to convert btrfs's dio_submit_t because of the dio
    submit_io callout use. The next patches will completely convert
    this code and the reset of the btrfs code paths.

    Signed-off-by: Mike Christie
    Reviewed-by: Christoph Hellwig
    Reviewed-by: Hannes Reinecke
    Signed-off-by: Jens Axboe

    Mike Christie
     
  • This has callers of submit_bio/submit_bio_wait set the bio->bi_rw
    instead of passing it in. This makes that use the same as
    generic_make_request and how we set the other bio fields.

    Signed-off-by: Mike Christie

    Fixed up fs/ext4/crypto.c

    Signed-off-by: Jens Axboe

    Mike Christie
     

28 May, 2016

1 commit

  • Currently direct writes inside i_size on a DIO_SKIP_HOLES filesystem are
    not allowed to allocate blocks(get_more_blocks() sets 'create' to 0
    before calling get_block() callback), if it's a sparse file, direct
    writes fall back to buffered writes to avoid stale data exposure from
    concurrent buffered read. But there're two cases that can result in
    stale data exposure are not correctly detected.

    1. The detection for "writing inside i_size" is not sufficient,
    writes can be treated as "extending writes" wrongly. For example,
    direct write 1FSB (file system block) to a 1FSB sparse file on
    ext2/3/4, starting from offset 0, in this case it's writing inside
    i_size, but 'create' is non-zero, because 'block_in_file' and
    '(i_size_read(inode) >> blkbits' are both zero.

    2. Direct writes starting from or beyong i_size (not inside i_size)
    also could trigger block allocation and expose stale data. For
    example, consider a sparse file with i_size of 2k, and a write to
    offset 2k or 3k into the file, with a filesystem block size of 4k.
    (Thanks to Jeff Moyer for pointing this case out in his review.)

    The first problem can be demostrated by running ltp-aiodio test ADSP045
    many times. When testing on extN filesystems, I see test failures
    occasionally, buffered read could read non-zero (stale) data.

    ADSP045: dio_sparse -a 4k -w 4k -s 2k -n 1

    dio_sparse 0 TINFO : Dirtying free blocks
    dio_sparse 0 TINFO : Starting I/O tests
    non zero buffer at buf[0] => 0xffffffaa,ffffffaa,ffffffaa,ffffffaa
    non-zero read at offset 0
    dio_sparse 0 TINFO : Killing childrens(s)
    dio_sparse 1 TFAIL : dio_sparse.c:191: 1 children(s) exited abnormally

    The second problem can also be reproduced easily by a hacked dio_sparse
    program, which accepts an option to specify the write offset.

    What we should really do is to disable block allocation for writes that
    could result in filling holes inside i_size.

    Link: http://lkml.kernel.org/r/1463156728-13357-1-git-send-email-guaneryu@gmail.com
    Reviewed-by: Jan Kara
    Signed-off-by: Eryu Guan
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eryu Guan
     

02 May, 2016

4 commits


05 Apr, 2016

1 commit

  • PAGE_CACHE_{SIZE,SHIFT,MASK,ALIGN} macros were introduced *long* time
    ago with promise that one day it will be possible to implement page
    cache with bigger chunks than PAGE_SIZE.

    This promise never materialized. And unlikely will.

    We have many places where PAGE_CACHE_SIZE assumed to be equal to
    PAGE_SIZE. And it's constant source of confusion on whether
    PAGE_CACHE_* or PAGE_* constant should be used in a particular case,
    especially on the border between fs and mm.

    Global switching to PAGE_CACHE_SIZE != PAGE_SIZE would cause to much
    breakage to be doable.

    Let's stop pretending that pages in page cache are special. They are
    not.

    The changes are pretty straight-forward:

    - << (PAGE_CACHE_SHIFT - PAGE_SHIFT) -> ;

    - >> (PAGE_CACHE_SHIFT - PAGE_SHIFT) -> ;

    - PAGE_CACHE_{SIZE,SHIFT,MASK,ALIGN} -> PAGE_{SIZE,SHIFT,MASK,ALIGN};

    - page_cache_get() -> get_page();

    - page_cache_release() -> put_page();

    This patch contains automated changes generated with coccinelle using
    script below. For some reason, coccinelle doesn't patch header files.
    I've called spatch for them manually.

    The only adjustment after coccinelle is revert of changes to
    PAGE_CAHCE_ALIGN definition: we are going to drop it later.

    There are few places in the code where coccinelle didn't reach. I'll
    fix them manually in a separate patch. Comments and documentation also
    will be addressed with the separate patch.

    virtual patch

    @@
    expression E;
    @@
    - E << (PAGE_CACHE_SHIFT - PAGE_SHIFT)
    + E

    @@
    expression E;
    @@
    - E >> (PAGE_CACHE_SHIFT - PAGE_SHIFT)
    + E

    @@
    @@
    - PAGE_CACHE_SHIFT
    + PAGE_SHIFT

    @@
    @@
    - PAGE_CACHE_SIZE
    + PAGE_SIZE

    @@
    @@
    - PAGE_CACHE_MASK
    + PAGE_MASK

    @@
    expression E;
    @@
    - PAGE_CACHE_ALIGN(E)
    + PAGE_ALIGN(E)

    @@
    expression E;
    @@
    - page_cache_get(E)
    + get_page(E)

    @@
    expression E;
    @@
    - page_cache_release(E)
    + put_page(E)

    Signed-off-by: Kirill A. Shutemov
    Acked-by: Michal Hocko
    Signed-off-by: Linus Torvalds

    Kirill A. Shutemov
     

22 Mar, 2016

1 commit

  • Pull xfs updates from Dave Chinner:
    "There's quite a lot in this request, and there's some cross-over with
    ext4, dax and quota code due to the nature of the changes being made.

    As for the rest of the XFS changes, there are lots of little things
    all over the place, which add up to a lot of changes in the end.

    The major changes are that we've reduced the size of the struct
    xfs_inode by ~100 bytes (gives an inode cache footprint reduction of
    >10%), the writepage code now only does a single set of mapping tree
    lockups so uses less CPU, delayed allocation reservations won't
    overrun under random write loads anymore, and we added compile time
    verification for on-disk structure sizes so we find out when a commit
    or platform/compiler change breaks the on disk structure as early as
    possible.

    Change summary:

    - error propagation for direct IO failures fixes for both XFS and
    ext4
    - new quota interfaces and XFS implementation for iterating all the
    quota IDs in the filesystem
    - locking fixes for real-time device extent allocation
    - reduction of duplicate information in the xfs and vfs inode, saving
    roughly 100 bytes of memory per cached inode.
    - buffer flag cleanup
    - rework of the writepage code to use the generic write clustering
    mechanisms
    - several fixes for inode flag based DAX enablement
    - rework of remount option parsing
    - compile time verification of on-disk format structure sizes
    - delayed allocation reservation overrun fixes
    - lots of little error handling fixes
    - small memory leak fixes
    - enable xfsaild freezing again"

    * tag 'xfs-for-linus-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs: (66 commits)
    xfs: always set rvalp in xfs_dir2_node_trim_free
    xfs: ensure committed is initialized in xfs_trans_roll
    xfs: borrow indirect blocks from freed extent when available
    xfs: refactor delalloc indlen reservation split into helper
    xfs: update freeblocks counter after extent deletion
    xfs: debug mode forced buffered write failure
    xfs: remove impossible condition
    xfs: check sizes of XFS on-disk structures at compile time
    xfs: ioends require logically contiguous file offsets
    xfs: use named array initializers for log item dumping
    xfs: fix computation of inode btree maxlevels
    xfs: reinitialise per-AG structures if geometry changes during recovery
    xfs: remove xfs_trans_get_block_res
    xfs: fix up inode32/64 (re)mount handling
    xfs: fix format specifier , should be %llx and not %llu
    xfs: sanitize remount options
    xfs: convert mount option parsing to tokens
    xfs: fix two memory leaks in xfs_attr_list.c error paths
    xfs: XFS_DIFLAG2_DAX limited by PAGE_SIZE
    xfs: dynamically switch modes when XFS_DIFLAG2_DAX is set/cleared
    ...

    Linus Torvalds
     

20 Mar, 2016

1 commit

  • Pull vfs updates from Al Viro:

    - Preparations of parallel lookups (the remaining main obstacle is the
    need to move security_d_instantiate(); once that becomes safe, the
    rest will be a matter of rather short series local to fs/*.c

    - preadv2/pwritev2 series from Christoph

    - assorted fixes

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (32 commits)
    splice: handle zero nr_pages in splice_to_pipe()
    vfs: show_vfsstat: do not ignore errors from show_devname method
    dcache.c: new helper: __d_add()
    don't bother with __d_instantiate(dentry, NULL)
    untangle fsnotify_d_instantiate() a bit
    uninline d_add()
    replace d_add_unique() with saner primitive
    quota: use lookup_one_len_unlocked()
    cifs_get_root(): use lookup_one_len_unlocked()
    nfs_lookup: don't bother with d_instantiate(dentry, NULL)
    kill dentry_unhash()
    ceph_fill_trace(): don't bother with d_instantiate(dn, NULL)
    autofs4: don't bother with d_instantiate(dentry, NULL) in ->lookup()
    configfs: move d_rehash() into configfs_create() for regular files
    ceph: don't bother with d_rehash() in splice_dentry()
    namei: teach lookup_slow() to skip revalidate
    namei: massage lookup_slow() to be usable by lookup_one_len_unlocked()
    lookup_one_len_unlocked(): use lookup_dcache()
    namei: simplify invalidation logics in lookup_dcache()
    namei: change calling conventions for lookup_{fast,slow} and follow_managed()
    ...

    Linus Torvalds
     

05 Mar, 2016

1 commit


08 Feb, 2016

1 commit

  • This way we can pass back errors to the file system, and allow for
    cleanup required for all direct I/O invocations.

    Also allow the ->end_io handlers to return errors on their own, so that
    I/O completion errors can be passed on to the callers.

    Signed-off-by: Christoph Hellwig
    Reviewed-by: Dave Chinner
    Signed-off-by: Dave Chinner

    Christoph Hellwig
     

31 Jan, 2016

1 commit

  • kasan reported the following error when i ran xfstest:

    [ 701.826854] ==================================================================
    [ 701.826864] BUG: KASAN: use-after-free in dio_bio_complete+0x41a/0x600 at addr ffff880080b95f94
    [ 701.826870] Read of size 4 by task loop2/3874
    [ 701.826879] page:ffffea000202e540 count:0 mapcount:0 mapping: (null) index:0x0
    [ 701.826890] flags: 0x100000000000000()
    [ 701.826895] page dumped because: kasan: bad access detected
    [ 701.826904] CPU: 3 PID: 3874 Comm: loop2 Tainted: G B W L 4.5.0-rc1-next-20160129 #83
    [ 701.826910] Hardware name: LENOVO 23205NG/23205NG, BIOS G2ET95WW (2.55 ) 07/09/2013
    [ 701.826917] ffff88008fadf800 ffff88008fadf758 ffffffff81ca67bb 0000000041b58ab3
    [ 701.826941] ffffffff830d1e74 ffffffff81ca6724 ffff88008fadf748 ffffffff8161c05c
    [ 701.826963] 0000000000000282 ffff88008fadf800 ffffed0010172bf2 ffffea000202e540
    [ 701.826987] Call Trace:
    [ 701.826997] [] dump_stack+0x97/0xdc
    [ 701.827005] [] ? _atomic_dec_and_lock+0xc4/0xc4
    [ 701.827014] [] ? __dump_page+0x32c/0x490
    [ 701.827023] [] kasan_report_error+0x5f3/0x8b0
    [ 701.827033] [] ? dio_bio_complete+0x41a/0x600
    [ 701.827040] [] __asan_report_load4_noabort+0x59/0x80
    [ 701.827048] [] ? dio_bio_complete+0x41a/0x600
    [ 701.827053] [] dio_bio_complete+0x41a/0x600
    [ 701.827057] [] ? blk_queue_exit+0x108/0x270
    [ 701.827060] [] dio_bio_end_aio+0xa0/0x4d0
    [ 701.827063] [] ? dio_bio_complete+0x600/0x600
    [ 701.827067] [] ? blk_account_io_completion+0x316/0x5d0
    [ 701.827070] [] bio_endio+0x79/0x200
    [ 701.827074] [] blk_update_request+0x1df/0xc50
    [ 701.827078] [] blk_mq_end_request+0x57/0x120
    [ 701.827081] [] __blk_mq_complete_request+0x310/0x590
    [ 701.827084] [] ? set_next_entity+0x2f8/0x2ed0
    [ 701.827088] [] ? put_prev_entity+0x22d/0x2a70
    [ 701.827091] [] blk_mq_complete_request+0x5b/0x80
    [ 701.827094] [] loop_queue_work+0x273/0x19d0
    [ 701.827098] [] ? finish_task_switch+0x1c8/0x8e0
    [ 701.827101] [] ? trace_hardirqs_on_caller+0x18/0x6c0
    [ 701.827104] [] ? lo_read_simple+0x890/0x890
    [ 701.827108] [] ? debug_check_no_locks_freed+0x350/0x350
    [ 701.827111] [] ? __hrtick_start+0x130/0x130
    [ 701.827115] [] ? __schedule+0x936/0x20b0
    [ 701.827118] [] ? kthread_worker_fn+0x3ed/0x8d0
    [ 701.827121] [] ? kthread_worker_fn+0x21d/0x8d0
    [ 701.827125] [] ? trace_hardirqs_on_caller+0x18/0x6c0
    [ 701.827128] [] kthread_worker_fn+0x2af/0x8d0
    [ 701.827132] [] ? __init_kthread_worker+0x170/0x170
    [ 701.827135] [] ? _raw_spin_unlock_irqrestore+0x36/0x60
    [ 701.827138] [] ? __init_kthread_worker+0x170/0x170
    [ 701.827141] [] ? __init_kthread_worker+0x170/0x170
    [ 701.827144] [] kthread+0x24b/0x3a0
    [ 701.827148] [] ? kthread_create_on_node+0x4c0/0x4c0
    [ 701.827151] [] ? trace_hardirqs_on+0xd/0x10
    [ 701.827155] [] ? do_group_exit+0xdd/0x350
    [ 701.827158] [] ? kthread_create_on_node+0x4c0/0x4c0
    [ 701.827161] [] ret_from_fork+0x3f/0x70
    [ 701.827165] [] ? kthread_create_on_node+0x4c0/0x4c0
    [ 701.827167] Memory state around the buggy address:
    [ 701.827170] ffff880080b95e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [ 701.827172] ffff880080b95f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [ 701.827175] >ffff880080b95f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [ 701.827177] ^
    [ 701.827179] ffff880080b96000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [ 701.827182] ffff880080b96080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
    [ 701.827183] ==================================================================

    The problem is that bio_check_pages_dirty calls bio_put, so we must
    not access bio fields after bio_check_pages_dirty.

    Fixes: 9b81c842355ac96097ba ("block: don't access bio->bi_error after bio_put()").
    Signed-off-by: Mike Krinkin
    Cc: stable@vger.kernel.org
    Signed-off-by: Jens Axboe

    Mike Krinkin
     

23 Jan, 2016

1 commit

  • parallel to mutex_{lock,unlock,trylock,is_locked,lock_nested},
    inode_foo(inode) being mutex_foo(&inode->i_mutex).

    Please, use those for access to ->i_mutex; over the coming cycle
    ->i_mutex will become rwsem, with ->lookup() done with it held
    only shared.

    Signed-off-by: Al Viro

    Al Viro
     

09 Dec, 2015

1 commit


01 Dec, 2015

1 commit

  • Assume a filesystem with 4KB blocks. When a file has size 1000 bytes and
    we issue direct IO read at offset 1024, blockdev_direct_IO() reads the
    tail of the last block and the logic for handling short DIO reads in
    dio_complete() results in a return value -24 (1000 - 1024) which
    obviously confuses userspace.

    Fix the problem by bailing out early once we sample i_size and can
    reliably check that direct IO read starts beyond i_size.

    Reported-by: Avi Kivity
    Fixes: 9fe55eea7e4b444bafc42fa0000cc2d1d2847275
    CC: stable@vger.kernel.org
    CC: Steven Whitehouse
    Signed-off-by: Jan Kara
    Signed-off-by: Jens Axboe

    Jan Kara