ext4: fix bug_on in ext4_writepages

PATCH Superseded Ye Bin 2 participants 4 messages May 10, 2022 – May 16, 2022 ext4 file system

Share & tools

Ye Bin

author

2022-05-10 09:48 UTC #0 lore raw

PATCH v2 1/1 ext4: fix bug_on in ext4_writepages

we got issue as follows:
EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls

------------[ cut here ]------------
kernel BUG at fs/ext4/inode.c:2708!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155
RIP: 0010:ext4_writepages+0x1977/0x1c10
RSP: 0018:ffff88811d3e7880 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000
RDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002
RBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000
R10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001
R13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028
FS:  00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_writepages+0x130/0x3a0
 filemap_fdatawrite_wbc+0x83/0xa0
 filemap_flush+0xab/0xe0
 ext4_alloc_da_blocks+0x51/0x120
 __ext4_ioctl+0x1534/0x3210
 __x64_sys_ioctl+0x12c/0x170
 do_syscall_64+0x3b/0x90

It may happen as follows:
1. write inline_data inode
vfs_write
new_sync_write

    ext4_file_write_iter
      ext4_buffered_write_iter
        generic_perform_write
          ext4_da_write_begin
            ext4_da_write_inline_data_begin -> If inline data size too
            small will allocate block to write, then mapping will has
            dirty page
                ext4_da_convert_inline_data_to_extent ->clear EXT4_STATE_MAY_INLINE_DATA
2. fallocate
do_vfs_ioctl
  ioctl_preallocate
    vfs_fallocate
      ext4_fallocate
        ext4_convert_inline_data
          ext4_convert_inline_data_nolock
            ext4_map_blocks -> fail will goto restore data
            ext4_restore_inline_data
              ext4_create_inline_data
              ext4_write_inline_data
              ext4_set_inode_state -> set inode EXT4_STATE_MAY_INLINE_DATA

3. writepages
__ext4_ioctl
ext4_alloc_da_blocks
filemap_flush
filemap_fdatawrite_wbc
do_writepages
ext4_writepages
if (ext4_has_inline_data(inode))
BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))

The root cause of this issue is we destory inline data until call ext4_writepages under delay allocation mode. But there maybe already covert from inline to extent. To solved this issue, we call filemap_flush firstly.

Signed-off-by Ye Bin <[email protected]>

---
 fs/ext4/inline.c | 8 ++++++++
 1 file changed, 8 insertions(+)

fs/ext4/inline.c +8 -0

index 6d253edebf9f..130ed5d83734 100644
@@ -2002,6 +2002,14 @@ int ext4_convert_inline_data(struct inode *inode)
 	if (!ext4_has_inline_data(inode)) {
 		ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
 		return 0;
+	} else if (test_opt(inode->i_sb, DELALLOC) && !S_ISDIR(inode->i_mode)) {
+		error = filemap_flush(inode->i_mapping);
+		if (error)
+			return error;
+		if (!ext4_has_inline_data(inode)) {
+			ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
+			return 0;
+		}
 	}
 
 	needed_blocks = ext4_writepage_trans_blocks(inode);

Signature · 1 line

2.31.1

Jan Kara

reviewer

2022-05-11 13:47 UTC #1 lore raw

Quoted 76 lines · Ye Bin

we got issue as follows:
EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls

------------[ cut here ]------------
kernel BUG at fs/ext4/inode.c:2708!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155
RIP: 0010:ext4_writepages+0x1977/0x1c10
RSP: 0018:ffff88811d3e7880 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000
RDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002
RBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000
R10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001
R13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028
FS:  00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_writepages+0x130/0x3a0
 filemap_fdatawrite_wbc+0x83/0xa0
 filemap_flush+0xab/0xe0
 ext4_alloc_da_blocks+0x51/0x120
 __ext4_ioctl+0x1534/0x3210
 __x64_sys_ioctl+0x12c/0x170
 do_syscall_64+0x3b/0x90

It may happen as follows:
1. write inline_data inode
vfs_write
new_sync_write

    ext4_file_write_iter
      ext4_buffered_write_iter
        generic_perform_write
          ext4_da_write_begin
            ext4_da_write_inline_data_begin -> If inline data size too
            small will allocate block to write, then mapping will has
            dirty page
                ext4_da_convert_inline_data_to_extent ->clear EXT4_STATE_MAY_INLINE_DATA
2. fallocate
do_vfs_ioctl
  ioctl_preallocate
    vfs_fallocate
      ext4_fallocate
        ext4_convert_inline_data
          ext4_convert_inline_data_nolock
            ext4_map_blocks -> fail will goto restore data
            ext4_restore_inline_data
              ext4_create_inline_data
              ext4_write_inline_data
              ext4_set_inode_state -> set inode EXT4_STATE_MAY_INLINE_DATA

Signed-off-by Ye Bin <[email protected]>

---
 fs/ext4/inline.c | 8 ++++++++
 1 file changed, 8 insertions(+)

fs/ext4/inline.c +0 -0

index 6d253edebf9f..130ed5d83734 100644

fs/ext4/inline.c int ext4_convert_inline_data(struct inode *inode) · line 2006

Quoted 5 lines

fs/ext4/inline.c +2 -0

@@ -2002,6 +2002,14 @@ int ext4_convert_inline_data(struct inode *inode)
 	if (!ext4_has_inline_data(inode)) {
 		ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
 		return 0;
+	} else if (test_opt(inode->i_sb, DELALLOC) && !S_ISDIR(inode->i_mode)) {
+		error = filemap_flush(inode->i_mapping);

This is actually an interesting option and I kind of like it but shouldn't we restrict this to the situation when EXT4_STATE_MAY_INLINE_DATA is clear? Otherwise we would be writing out inline data to the inode unnecessarily for each ext4_convert_inline_data() call.

Honza

Signature · 2 lines

Jan Kara <[email protected]>
SUSE Labs, CR

yebin

author

2022-05-14 09:28 UTC #2 lore raw

Quoted 87 lines · Jan Kara

Quoted 76 lines · Ye Bin
we got issue as follows:
EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls
------------[ cut here ]------------
kernel BUG at fs/ext4/inode.c:2708!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155
RIP: 0010:ext4_writepages+0x1977/0x1c10
RSP: 0018:ffff88811d3e7880 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000
RDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002
RBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000
R10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001
R13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028
FS:  00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  <TASK>
  do_writepages+0x130/0x3a0
  filemap_fdatawrite_wbc+0x83/0xa0
  filemap_flush+0xab/0xe0
  ext4_alloc_da_blocks+0x51/0x120
  __ext4_ioctl+0x1534/0x3210
  __x64_sys_ioctl+0x12c/0x170
  do_syscall_64+0x3b/0x90
It may happen as follows:
1. write inline_data inode
vfs_write
new_sync_write
     ext4_file_write_iter
       ext4_buffered_write_iter
         generic_perform_write
           ext4_da_write_begin
             ext4_da_write_inline_data_begin -> If inline data size too
             small will allocate block to write, then mapping will has
             dirty page
                 ext4_da_convert_inline_data_to_extent ->clear EXT4_STATE_MAY_INLINE_DATA
2. fallocate
do_vfs_ioctl
   ioctl_preallocate
     vfs_fallocate
       ext4_fallocate
         ext4_convert_inline_data
           ext4_convert_inline_data_nolock
             ext4_map_blocks -> fail will goto restore data
             ext4_restore_inline_data
               ext4_create_inline_data
               ext4_write_inline_data
               ext4_set_inode_state -> set inode EXT4_STATE_MAY_INLINE_DATA
3. writepages
__ext4_ioctl
ext4_alloc_da_blocks
filemap_flush
filemap_fdatawrite_wbc
do_writepages
ext4_writepages
if (ext4_has_inline_data(inode))
BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
The root cause of this issue is we destory inline data until call ext4_writepages under delay allocation mode. But there maybe already covert from inline to extent. To solved this issue, we call filemap_flush firstly.
Signed-off-by Ye Bin <[email protected]>
---
  fs/ext4/inline.c | 8 ++++++++
  1 file changed, 8 insertions(+)
fs/ext4/inline.c +0 -0
index 6d253edebf9f..130ed5d83734 100644
fs/ext4/inline.c int ext4_convert_inline_data(struct inode *inode) · line 2006
Quoted 5 lines
fs/ext4/inline.c +2 -0
@@ -2002,6 +2002,14 @@ int ext4_convert_inline_data(struct inode *inode)
  	if (!ext4_has_inline_data(inode)) {
  		ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
  		return 0;
+	} else if (test_opt(inode->i_sb, DELALLOC) && !S_ISDIR(inode->i_mode)) {
+		error = filemap_flush(inode->i_mapping);
This is actually an interesting option and I kind of like it but shouldn't we restrict this to the situation when EXT4_STATE_MAY_INLINE_DATA is clear? Otherwise we would be writing out inline data to the inode unnecessarily for each ext4_convert_inline_data() call.

Quoted 1 line

Honza

Acctually, this issue only exist in delay allocate mode. Do we need to restrict this to “test_opt(inode->i_sb, DELALLOC)” as follows ?
@@ -2002,6 +2002,13 @@ int ext4_convert_inline_data(struct inode *inode)

        if (!ext4_has_inline_data(inode)) {
                ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
                return 0;

+ } else if (test_opt(inode->i_sb, DELALLOC) &&
+ !ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) {
+ error = filemap_flush(inode->i_mapping);
+ if (error)
+ return error;
+ if (!ext4_has_inline_data(inode))

+                       return 0;
        }

yebin

author

2022-05-16 01:09 UTC #3 lore raw

Quoted 95 lines · yebin

Quoted 92 lines · Jan Kara
Quoted 79 lines · Ye Bin
we got issue as follows:
EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls
------------[ cut here ]------------
kernel BUG at fs/ext4/inode.c:2708!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155
RIP: 0010:ext4_writepages+0x1977/0x1c10
RSP: 0018:ffff88811d3e7880 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000
RDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002
RBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000
R10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001
R13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028
FS:  00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  <TASK>
  do_writepages+0x130/0x3a0
  filemap_fdatawrite_wbc+0x83/0xa0
  filemap_flush+0xab/0xe0
  ext4_alloc_da_blocks+0x51/0x120
  __ext4_ioctl+0x1534/0x3210
  __x64_sys_ioctl+0x12c/0x170
  do_syscall_64+0x3b/0x90
It may happen as follows:
1. write inline_data inode
vfs_write
new_sync_write
     ext4_file_write_iter
       ext4_buffered_write_iter
         generic_perform_write
           ext4_da_write_begin
             ext4_da_write_inline_data_begin -> If inline data size too
             small will allocate block to write, then mapping will has
             dirty page
                 ext4_da_convert_inline_data_to_extent ->clear 
EXT4_STATE_MAY_INLINE_DATA
2. fallocate
do_vfs_ioctl
ioctl_preallocate
     vfs_fallocate
       ext4_fallocate
         ext4_convert_inline_data
           ext4_convert_inline_data_nolock
             ext4_map_blocks -> fail will goto restore data
             ext4_restore_inline_data
               ext4_create_inline_data
               ext4_write_inline_data
               ext4_set_inode_state -> set inode 
EXT4_STATE_MAY_INLINE_DATA
3. writepages
__ext4_ioctl
ext4_alloc_da_blocks
filemap_flush
filemap_fdatawrite_wbc
do_writepages
ext4_writepages
if (ext4_has_inline_data(inode))
BUG_ON(ext4_test_inode_state(inode,
EXT4_STATE_MAY_INLINE_DATA))
The root cause of this issue is we destory inline data until call ext4_writepages under delay allocation mode. But there maybe already covert from inline to extent. To solved this issue, we call filemap_flush firstly.
Signed-off-by Ye Bin <[email protected]>
---
  fs/ext4/inline.c | 8 ++++++++
  1 file changed, 8 insertions(+)
fs/ext4/inline.c +0 -0
index 6d253edebf9f..130ed5d83734 100644
fs/ext4/inline.c int ext4_convert_inline_data(struct inode · line 2008
Quoted 7 lines
fs/ext4/inline.c +2 -0
@@ -2002,6 +2002,14 @@ int ext4_convert_inline_data(struct inode 
 *inode)
      if (!ext4_has_inline_data(inode)) {
          ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
          return 0;
+    } else if (test_opt(inode->i_sb, DELALLOC) && 
 !S_ISDIR(inode->i_mode)) {
+        error = filemap_flush(inode->i_mapping);
This is actually an interesting option and I kind of like it but shouldn't we restrict this to the situation when EXT4_STATE_MAY_INLINE_DATA is clear? Otherwise we would be writing out inline data to the inode unnecessarily for each ext4_convert_inline_data() call.

Quoted 3 lines

Quoted 1 line
Honza
Acctually, this issue only exist in delay allocate mode. Do we need to restrict this to “test_opt(inode->i_sb, DELALLOC)” as follows ?

I've looked again. There's no need to add this constraint. I'll send v2 patch.

Quoted 18 lines

fs/ext4/inline.c +7 -0

@@ -2002,6 +2002,13 @@ int ext4_convert_inline_data(struct inode *inode)
        if (!ext4_has_inline_data(inode)) {
                ext4_clear_inode_state(inode, 
 EXT4_STATE_MAY_INLINE_DATA);
                return 0;
+       } else if (test_opt(inode->i_sb, DELALLOC) &&
+                  !ext4_test_inode_state(inode, 
 EXT4_STATE_MAY_INLINE_DATA)) {
+               error = filemap_flush(inode->i_mapping);
+               if (error)
+                       return error;
+               if (!ext4_has_inline_data(inode))
+                       return 0;
        }