linux-ext4 - Re: [PATCH] jbd jbd2: fix dio write returning EIOwhentry_to_release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 06 Aug 2008 11:04:38 +0900
From:	Hisashi Hifumi <hifumi.hisashi@....ntt.co.jp>
To:	Mingming Cao <cmm@...ibm.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>, jack@...e.cz,
	linux-ext4@...r.kernel.org, linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH] jbd jbd2: fix dio write returning
  EIOwhentry_to_release_page fails


At 06:35 08/08/06, Mingming Cao wrote:
>
>蝨ィ 2008-08-05莠檎噪 11:36 +0900�招�isashi Hifumi蜀咎％�肖.
>> >> 
>> >> diff -Nrup linux-2.6.27-rc1.org/fs/jbd/transaction.c 
>> >linux-2.6.27-rc1/fs/jbd/transaction.c
>> >> --- linux-2.6.27-rc1.org/fs/jbd/transaction.c	2008-07-29 
>> >19:28:47.000000000 +0900
>> >> +++ linux-2.6.27-rc1/fs/jbd/transaction.c	2008-07-29 
>20:40:12.000000000 +0900
>> >> @@ -1764,6 +1764,12 @@ int journal_try_to_free_buffers(journal_
>> >>  	*/
>> >>  	if (ret == 0 && (gfp_mask & __GFP_WAIT) && (gfp_mask & __GFP_FS)) {
>> >>  		journal_wait_for_transaction_sync_data(journal);
>> >> +
>> >> +		bh = head;
>> >> +		do {
>> >> +			while (atomic_read(&bh->b_count))
>> >> +				schedule();
>> >> +		} while ((bh = bh->b_this_page) != head);
>> >>  		ret = try_to_free_buffers(page);
>> >>  	}
>> >
>> >The loop is problematic.  If the scheduler decides to keep running this
>> >task then we have a busy loop.  If this task has realtime policy then
>> >it might even lock up the kernel.
>> > 
>> >Perhaps we can use wait_on_page_writeback()?
>> >
>> 
>> We cannot use wait_on_page_writeback() to wait for releasing bh ref because
>> in ext3_ordered_writepage() bh ref is grabbed and released through 
>walk_page_buffers
>> so between both walk_page_buffers, it remains taking a bh ref even if 
>end_page_writeback
>> is performed.
>>       ->ext3_ordered_writepage()
>>      	   walk_page_buffers() <- take a bh ref
>>  	   block_write_full_page() <- unlock_page
>> 		: <- end_page_writeback
>>                 : <- race! (dio write->try_to_release_page fails): ---> 
>remains taking a bh ref
>>       	   walk_page_buffers() <-release a bh ref
>> 
>
>Okay, I see the race window, DIO could come in before
>walk_page_buffers() release the bh reference. So far I don't see a nicer
>way to sync between background  writeout with DIO path yet...
>

I know that b_count check on loop is not good, but I do not have better 
idea to fix this yet too.
The race window is very short and rare, so I think the impact of introducing
the loop is small even if this loop can be busy loop due to scheduler circumstances.

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html