This is a note to let you know that I've just added the patch titled xfs: fix missing CoW blocks writeback conversion retry to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xfs-fix-missing-cow-blocks-writeback-conversion-retry.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From chandan.babu@xxxxxxxxxx Thu Feb 16 06:23:08 2023 From: Chandan Babu R <chandan.babu@xxxxxxxxxx> Date: Thu, 16 Feb 2023 10:50:15 +0530 Subject: xfs: fix missing CoW blocks writeback conversion retry To: gregkh@xxxxxxxxxxxxxxxxxxx Cc: sashal@xxxxxxxxxx, mcgrof@xxxxxxxxxx, linux-xfs@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, djwong@xxxxxxxxxx, chandan.babu@xxxxxxxxxx, amir73il@xxxxxxxxx, leah.rumancik@xxxxxxxxx Message-ID: <20230216052019.368896-22-chandan.babu@xxxxxxxxxx> From: "Darrick J. Wong" <darrick.wong@xxxxxxxxxx> commit c2f09217a4305478c55adc9a98692488dd19cd32 upstream. [ Set xfs_writepage_ctx->fork to XFS_DATA_FORK since 5.4.y tracks current extent's fork in this variable ] In commit 7588cbeec6df, we tried to fix a race stemming from the lack of coordination between higher level code that wants to allocate and remap CoW fork extents into the data fork. Christoph cites as examples the always_cow mode, and a directio write completion racing with writeback. According to the comments before the goto retry, we want to restart the lookup to catch the extent in the data fork, but we don't actually reset whichfork or cow_fsb, which means the second try executes using stale information. Up until now I think we've gotten lucky that either there's something left in the CoW fork to cause cow_fsb to be reset, or either data/cow fork sequence numbers have advanced enough to force a fresh lookup from the data fork. However, if we reach the retry with an empty stable CoW fork and a stable data fork, neither of those things happens. The retry foolishly re-calls xfs_convert_blocks on the CoW fork which fails again. This time, we toss the write. I've recently been working on extending reflink to the realtime device. When the realtime extent size is larger than a single block, we have to force the page cache to CoW the entire rt extent if a write (or fallocate) are not aligned with the rt extent size. The strategy I've chosen to deal with this is derived from Dave's blocksize > pagesize series: dirtying around the write range, and ensuring that writeback always starts mapping on an rt extent boundary. This has brought this race front and center, since generic/522 blows up immediately. However, I'm pretty sure this is a bug outright, independent of that. Fixes: 7588cbeec6df ("xfs: retry COW fork delalloc conversion when no extent was found") Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx> Reviewed-by: Christoph Hellwig <hch@xxxxxx> Signed-off-by: Chandan Babu R <chandan.babu@xxxxxxxxxx> Acked-by: Darrick J. Wong <djwong@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/xfs/xfs_aops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -495,7 +495,7 @@ xfs_map_blocks( ssize_t count = i_blocksize(inode); xfs_fileoff_t offset_fsb = XFS_B_TO_FSBT(mp, offset); xfs_fileoff_t end_fsb = XFS_B_TO_FSB(mp, offset + count); - xfs_fileoff_t cow_fsb = NULLFILEOFF; + xfs_fileoff_t cow_fsb; struct xfs_bmbt_irec imap; struct xfs_iext_cursor icur; int retries = 0; @@ -529,6 +529,8 @@ xfs_map_blocks( * landed in a hole and we skip the block. */ retry: + cow_fsb = NULLFILEOFF; + wpc->fork = XFS_DATA_FORK; xfs_ilock(ip, XFS_ILOCK_SHARED); ASSERT(ip->i_d.di_format != XFS_DINODE_FMT_BTREE || (ip->i_df.if_flags & XFS_IFEXTENTS)); Patches currently in stable-queue which might be from chandan.babu@xxxxxxxxxx are queue-5.4/xfs-remove-the-xfs_efd_log_item_t-typedef.patch queue-5.4/xfs-change-the-order-in-which-child-and-parent-defer-ops-are-finished.patch queue-5.4/xfs-refactor-xfs_defer_finish_noroll.patch queue-5.4/xfs-sync-lazy-sb-accounting-on-quiesce-of-read-only-mounts.patch queue-5.4/xfs-clean-up-xfs_bui_item_recover-iget-trans_alloc-ilock-ordering.patch queue-5.4/xfs-xfs_defer_capture-should-absorb-remaining-block-reservations.patch queue-5.4/xfs-factor-out-a-xfs_defer_create_intent-helper.patch queue-5.4/xfs-turn-dfp_intent-into-a-xfs_log_item.patch queue-5.4/xfs-fix-finobt-btree-block-recovery-ordering.patch queue-5.4/xfs-xfs_defer_capture-should-absorb-remaining-transaction-reservation.patch queue-5.4/xfs-merge-the-diff_items-defer-op-into-create_intent.patch queue-5.4/xfs-prevent-uaf-in-xfs_log_item_in_current_chkpt.patch queue-5.4/xfs-fix-missing-cow-blocks-writeback-conversion-retry.patch queue-5.4/xfs-remove-the-xfs_efi_log_item_t-typedef.patch queue-5.4/xfs-only-relog-deferred-intent-items-if-free-space-in-the-log-gets-low.patch queue-5.4/xfs-proper-replay-of-deferred-ops-queued-during-log-recovery.patch queue-5.4/xfs-clean-up-bmap-intent-item-recovery-checking.patch queue-5.4/xfs-fix-the-forward-progress-assertion-in-xfs_iwalk_run_callbacks.patch queue-5.4/xfs-log-new-intent-items-created-as-part-of-finishing-recovered-intent-items.patch queue-5.4/xfs-ensure-inobt-record-walks-always-make-forward-progress.patch queue-5.4/xfs-remove-the-xfs_inode_log_item_t-typedef.patch queue-5.4/xfs-fix-an-incore-inode-uaf-in-xfs_bui_recover.patch queue-5.4/xfs-expose-the-log-push-threshold.patch queue-5.4/xfs-periodically-relog-deferred-intent-items.patch queue-5.4/xfs-merge-the-log_item-defer-op-into-create_intent.patch