Re: [PATCH v2] xfs: fix BUG_ON in xfs_getbmap()

[yebin (H)]

On 2023/3/29 9:02, Darrick J. Wong wrote:
> On Tue, Mar 28, 2023 at 10:21:29PM +0800, Ye Bin wrote:
> > From: Ye Bin <yebin10@xxxxxxxxxx>
> >
> > There's issue as follows:
> > XFS: Assertion failed: (bmv->bmv_iflags & BMV_IF_DELALLOC) != 0, file: fs/xfs/xfs_bmap_util.c, line: 329
> > ------------[ cut here ]------------
> > kernel BUG at fs/xfs/xfs_message.c:102!
> > invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> > CPU: 1 PID: 14612 Comm: xfs_io Not tainted 6.3.0-rc2-next-20230315-00006-g2729d23ddb3b-dirty #422
> > RIP: 0010:assfail+0x96/0xa0
> > RSP: 0018:ffffc9000fa178c0 EFLAGS: 00010246
> > RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff888179a18000
> > RDX: 0000000000000000 RSI: ffff888179a18000 RDI: 0000000000000002
> > RBP: 0000000000000000 R08: ffffffff8321aab6 R09: 0000000000000000
> > R10: 0000000000000001 R11: ffffed1105f85139 R12: ffffffff8aacc4c0
> > R13: 0000000000000149 R14: ffff888269f58000 R15: 000000000000000c
> > FS:  00007f42f27a4740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000000000b92388 CR3: 000000024f006000 CR4: 00000000000006e0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> >   <TASK>
> >   xfs_getbmap+0x1a5b/0x1e40
> >   xfs_ioc_getbmap+0x1fd/0x5b0
> >   xfs_file_ioctl+0x2cb/0x1d50
> >   __x64_sys_ioctl+0x197/0x210
> >   do_syscall_64+0x39/0xb0
> >   entry_SYSCALL_64_after_hwframe+0x63/0xcd
> >
> > Above issue may happen as follows:
> >           ThreadA                       ThreadB
> > do_shared_fault
> >   __do_fault
> >    xfs_filemap_fault
> >     __xfs_filemap_fault
> >      filemap_fault
> >                               xfs_ioc_getbmap -> Without BMV_IF_DELALLOC flag
> > 			      xfs_getbmap
> > 			       xfs_ilock(ip, XFS_IOLOCK_SHARED);
> > 			       filemap_write_and_wait
> >   do_page_mkwrite
> >    xfs_filemap_page_mkwrite
> >     __xfs_filemap_fault
> >      xfs_ilock(XFS_I(inode), XFS_MMAPLOCK_SHARED);
> >      iomap_page_mkwrite
> >       ...
> >       xfs_buffered_write_iomap_begin
> >        xfs_bmapi_reserve_delalloc -> Allocate delay extent
> >                                xfs_ilock_data_map_shared(ip)
> > 	                      xfs_getbmap_report_one
> > 			       ASSERT((bmv->bmv_iflags & BMV_IF_DELALLOC) != 0)
> > 	                        -> trigger BUG_ON
> >
> > As xfs_filemap_page_mkwrite() only hold XFS_MMAPLOCK_SHARED lock, there's
> > small window mkwrite can produce delay extent after file write in xfs_getbmap().
> > To solve above issue, just skip delalloc extents.
> >
> > Signed-off-by: Ye Bin <yebin10@xxxxxxxxxx>
> > ---
> >   fs/xfs/xfs_bmap_util.c | 3 ++-
> >   1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
> > index a09dd2606479..d2a109ceb922 100644
> > --- a/fs/xfs/xfs_bmap_util.c
> > +++ b/fs/xfs/xfs_bmap_util.c
> > @@ -322,7 +322,8 @@ xfs_getbmap_report_one(
> >   		 * extents.
> >   		 */
> >   		if (got->br_startoff < XFS_B_TO_FSB(ip->i_mount, XFS_ISIZE(ip)))
> > -			ASSERT((bmv->bmv_iflags & BMV_IF_DELALLOC) != 0);
> > +			if (!(bmv->bmv_iflags & BMV_IF_DELALLOC))
> > +				return 0;
> Why only hide the delalloc mapping if it's below EOF?
>
> --D
There should be no concurrency issues with normal buffer writes. But 
since we need
to skip here, we won't make any distinction. I will send another version.
> >   
> >   		p->bmv_oflags |= BMV_OF_DELALLOC;
> >   		p->bmv_block = -2;
> > --
> > 2.31.1
> .