This is a note to let you know that I've just added the patch titled
xfs: fix an off-by-one error in xreap_agextent_binval
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xfs-fix-an-off-by-one-error-in-xreap_agextent_binval.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From stable+bounces-32423-greg=kroah.com@xxxxxxxxxxxxxxx Wed Mar 27 01:13:36 2024
From: Catherine Hoang <catherine.hoang@xxxxxxxxxx>
Date: Tue, 26 Mar 2024 17:12:23 -0700
Subject: xfs: fix an off-by-one error in xreap_agextent_binval
To: stable@xxxxxxxxxxxxxxx
Cc: linux-xfs@xxxxxxxxxxxxxxx
Message-ID: <20240327001233.51675-15-catherine.hoang@xxxxxxxxxx>
From: "Darrick J. Wong" <djwong@xxxxxxxxxx>
commit c0e37f07d2bd3c1ee3fb5a650da7d8673557ed16 upstream.
Overall, this function tries to find and invalidate all buffers for a
given extent of space on the data device. The inner for loop in this
function tries to find all xfs_bufs for a given daddr. The lengths of
all possible cached buffers range from 1 fsblock to the largest needed
to contain a 64k xattr value (~17fsb). The scan is capped to avoid
looking at anything buffer going past the given extent.
Unfortunately, the loop continuation test is wrong -- max_fsbs is the
largest size we want to scan, not one past that. Put another way, this
loop is actually 1-indexed, not 0-indexed. Therefore, the continuation
test should use <=, not <.
As a result, online repairs of btree blocks fails to stale any buffers
for btrees that are being torn down, which causes later assertions in
the buffer cache when another thread creates a different-sized buffer.
This happens in xfs/709 when allocating an inode cluster buffer:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3346128 at fs/xfs/xfs_message.c:104 assfail+0x3a/0x40 [xfs]
CPU: 0 PID: 3346128 Comm: fsstress Not tainted 6.7.0-rc4-djwx #rc4
RIP: 0010:assfail+0x3a/0x40 [xfs]
Call Trace:
<TASK>
_xfs_buf_obj_cmp+0x4a/0x50
xfs_buf_get_map+0x191/0xba0
xfs_trans_get_buf_map+0x136/0x280
xfs_ialloc_inode_init+0x186/0x340
xfs_ialloc_ag_alloc+0x254/0x720
xfs_dialloc+0x21f/0x870
xfs_create_tmpfile+0x1a9/0x2f0
xfs_rename+0x369/0xfd0
xfs_vn_rename+0xfa/0x170
vfs_rename+0x5fb/0xc30
do_renameat2+0x52d/0x6e0
__x64_sys_renameat2+0x4b/0x60
do_syscall_64+0x3b/0xe0
entry_SYSCALL_64_after_hwframe+0x46/0x4e
A later refactoring patch in the online repair series fixed this by
accident, which is why I didn't notice this until I started testing only
the patches that are likely to end up in 6.8.
Fixes: 1c7ce115e521 ("xfs: reap large AG metadata extents when possible")
Signed-off-by: "Darrick J. Wong" <djwong@xxxxxxxxxx>
Reviewed-by: Dave Chinner <dchinner@xxxxxxxxxx>
Signed-off-by: Chandan Babu R <chandanbabu@xxxxxxxxxx>
Signed-off-by: Catherine Hoang <catherine.hoang@xxxxxxxxxx>
Acked-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/xfs/scrub/reap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/scrub/reap.c
+++ b/fs/xfs/scrub/reap.c
@@ -247,7 +247,7 @@ xreap_agextent_binval(
max_fsbs = min_t(xfs_agblock_t, agbno_next - bno,
xfs_attr3_rmt_blocks(mp, XFS_XATTR_SIZE_MAX));
- for (fsbcount = 1; fsbcount < max_fsbs; fsbcount++) {
+ for (fsbcount = 1; fsbcount <= max_fsbs; fsbcount++) {
struct xfs_buf *bp = NULL;
xfs_daddr_t daddr;
int error;
Patches currently in stable-queue which might be from kroah.com@xxxxxxxxxxxxxxx are
queue-6.6/xfs-fix-32-bit-truncation-in-xfs_compute_rextslog.patch
queue-6.6/xfs-transfer-recovered-intent-item-ownership-in-iop_recover.patch
queue-6.6/xfs-initialise-di_crc-in-xfs_log_dinode.patch
queue-6.6/xfs-add-missing-nrext64-inode-flag-check-to-scrub.patch
queue-6.6/xfs-consider-minlen-sized-extents-in-xfs_rtallocate_extent_block.patch
queue-6.6/xfs-don-t-leak-recovered-attri-intent-items.patch
queue-6.6/xfs-remove-unused-fields-from-struct-xbtree_ifakeroot.patch
queue-6.6/xfs-ensure-logflagsp-is-initialized-in-xfs_bmap_del_extent_real.patch
queue-6.6/xfs-convert-rt-bitmap-extent-lengths-to-xfs_rtbxlen_t.patch
queue-6.6/xfs-fix-perag-leak-when-growfs-fails.patch
queue-6.6/xfs-pass-the-xfs_defer_pending-object-to-iop_recover.patch
queue-6.6/xfs-update-dir3-leaf-block-metadata-after-swap.patch
queue-6.6/xfs-make-rextslog-computation-consistent-with-mkfs.patch
queue-6.6/xfs-move-the-xfs_rtbitmap.c-declarations-to-xfs_rtbitmap.h.patch
queue-6.6/xfs-recompute-growfsrtfree-transaction-reservation-while-growing-rt-volume.patch
queue-6.6/xfs-force-all-buffers-to-be-written-during-btree-bulk-load.patch
queue-6.6/xfs-make-xchk_iget-safer-in-the-presence-of-corrupt-inode-btrees.patch
queue-6.6/xfs-reset-xfs_attr_incomplete-filter-on-node-removal.patch
queue-6.6/xfs-fix-an-off-by-one-error-in-xreap_agextent_binval.patch
queue-6.6/xfs-short-circuit-xfs_growfs_data_private-if-delta-is-zero.patch
queue-6.6/xfs-add-lock-protection-when-remove-perag-from-radix-tree.patch
queue-6.6/xfs-use-xfs_defer_pending-objects-to-recover-intent-items.patch
queue-6.6/xfs-don-t-allow-overly-small-or-large-realtime-volumes.patch
queue-6.6/xfs-remove-conditional-building-of-rt-geometry-validator-functions.patch
