android_kernel_samsung_univ.../fs/nilfs2
Andreas Rohner 7d7b05e4ff nilfs2: fix race condition that causes file system corruption
commit 31ccb1f7ba3cfe29631587d451cf5bb8ab593550 upstream.

There is a race condition between nilfs_dirty_inode() and
nilfs_set_file_dirty().

When a file is opened, nilfs_dirty_inode() is called to update the
access timestamp in the inode.  It calls __nilfs_mark_inode_dirty() in a
separate transaction.  __nilfs_mark_inode_dirty() caches the ifile
buffer_head in the i_bh field of the inode info structure and marks it
as dirty.

After some data was written to the file in another transaction, the
function nilfs_set_file_dirty() is called, which adds the inode to the
ns_dirty_files list.

Then the segment construction calls nilfs_segctor_collect_dirty_files(),
which goes through the ns_dirty_files list and checks the i_bh field.
If there is a cached buffer_head in i_bh it is not marked as dirty
again.

Since nilfs_dirty_inode() and nilfs_set_file_dirty() use separate
transactions, it is possible that a segment construction that writes out
the ifile occurs in-between the two.  If this happens the inode is not
on the ns_dirty_files list, but its ifile block is still marked as dirty
and written out.

In the next segment construction, the data for the file is written out
and nilfs_bmap_propagate() updates the b-tree.  Eventually the bmap root
is written into the i_bh block, which is not dirty, because it was
written out in another segment construction.

As a result the bmap update can be lost, which leads to file system
corruption.  Either the virtual block address points to an unallocated
DAT block, or the DAT entry will be reused for something different.

The error can remain undetected for a long time.  A typical error
message would be one of the "bad btree" errors or a warning that a DAT
entry could not be found.

This bug can be reproduced reliably by a simple benchmark that creates
and overwrites millions of 4k files.

Link: http://lkml.kernel.org/r/1509367935-3086-2-git-send-email-konishi.ryusuke@lab.ntt.co.jp
Signed-off-by: Andreas Rohner <andreas.rohner@gmx.net>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Andreas Rohner <andreas.rohner@gmx.net>
Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-30 08:37:20 +00:00
..
alloc.c nilfs2: fix gcc unused-but-set-variable warnings 2015-11-06 17:50:42 -08:00
alloc.h nilfs2: free unused dat file blocks during garbage collection 2015-11-06 17:50:42 -08:00
bmap.c nilfs2: add bmap function to seek a valid key 2015-04-17 09:04:03 -04:00
bmap.h nilfs2: add bmap function to seek a valid key 2015-04-17 09:04:03 -04:00
btnode.c fs: add i_blocksize() 2017-06-14 13:16:24 +02:00
btnode.h nilfs2: add omitted comments for different structures in driver implementation 2012-07-30 17:25:19 -07:00
btree.c nilfs2: fix gcc uninitialized-variable warnings in powerpc build 2015-11-06 17:50:42 -08:00
btree.h nilfs2: get rid of nilfs_bmap_union 2010-07-23 10:02:14 +09:00
cpfile.c nilfs2: improve execution time of NILFS_IOCTL_GET_CPINFO ioctl 2015-04-17 09:04:04 -04:00
cpfile.h nilfs2: use iget for all metadata files 2010-10-23 09:24:38 +09:00
dat.c nilfs2: fix gcc unused-but-set-variable warnings 2015-11-06 17:50:42 -08:00
dat.h nilfs2: use iget for all metadata files 2010-10-23 09:24:38 +09:00
dir.c pagemap.h: move dir_pages() over there 2015-06-23 18:02:00 -04:00
direct.c nilfs2: add bmap function to seek a valid key 2015-04-17 09:04:03 -04:00
direct.h nilfs2: get rid of nilfs_bmap_union 2010-07-23 10:02:14 +09:00
export.h nilfs2: add omitted comments for different structures in driver implementation 2012-07-30 17:25:19 -07:00
file.c vfs: remove unused wrapper block_page_mkwrite() 2015-11-11 02:19:33 -05:00
gcinode.c fs: remove mapping->backing_dev_info 2015-01-20 14:03:05 -07:00
ifile.c ] nilfs2: use atomic64_t type for inodes_count and blocks_count fields in nilfs_root struct 2013-07-03 16:08:01 -07:00
ifile.h nilfs2: implement calculation of free inodes count 2013-07-03 16:08:01 -07:00
inode.c fs: add i_blocksize() 2017-06-14 13:16:24 +02:00
ioctl.c ioctl_compat: handle FITRIM 2015-07-09 11:42:21 -07:00
Kconfig fs/nilfs2: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:39:04 -08:00
Makefile nilfs2: integrate sysfs support into driver 2014-08-08 15:57:21 -07:00
mdt.c fs: add i_blocksize() 2017-06-14 13:16:24 +02:00
mdt.h mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM 2015-11-06 17:50:42 -08:00
namei.c fs/nilfs2/namei.c: remove unnecessary new_valid_dev() check 2015-11-09 15:11:24 -08:00
nilfs.h nilfs2: fix deadlock of segment constructor over I_SYNC flag 2015-02-05 13:35:29 -08:00
page.c nilfs2: use set_mask_bits() for operations on buffer state bitmap 2015-04-17 09:04:03 -04:00
page.h fs: remove mapping->backing_dev_info 2015-01-20 14:03:05 -07:00
recovery.c nilfs2: fix gcc uninitialized-variable warnings in powerpc build 2015-11-06 17:50:42 -08:00
segbuf.c block: remove bio_get_nr_vecs() 2015-08-13 12:32:04 -06:00
segbuf.h nilfs2: get rid of macros for segment summary information 2010-07-23 10:02:09 +09:00
segment.c nilfs2: fix race condition that causes file system corruption 2017-11-30 08:37:20 +00:00
segment.h nilfs2: add a tracepoint for tracking stage transition of segment construction 2015-11-06 17:50:42 -08:00
sufile.c nilfs2: fix gcc unused-but-set-variable warnings 2015-11-06 17:50:42 -08:00
sufile.h nilfs2: add nilfs_sufile_trim_fs to trim clean segs 2014-04-03 16:21:25 -07:00
super.c nilfs2: fix gcc uninitialized-variable warnings in powerpc build 2015-11-06 17:50:42 -08:00
sysfs.c nilfs2: integrate sysfs support into driver 2014-08-08 15:57:21 -07:00
sysfs.h nilfs2: add /sys/fs/nilfs2/<device>/mounted_snapshots/<snapshot> group 2014-08-08 15:57:21 -07:00
the_nilfs.c fs/nilfs2: fix potential underflow in call to crc32_le 2016-08-10 11:49:25 +02:00
the_nilfs.h nilfs2: add missing blkdev_issue_flush() to nilfs_sync_fs() 2014-10-14 02:18:20 +02:00