linux-kernel - 答复: [RFC] ubi: ubi_wl_get_peb: Replace a limited number of attempts with polling while getting PEB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0B80F9D4116B2F4484E7279D5A66984F7A85FB@dggemi524-mbx.china.huawei.com>
Date:   Thu, 1 Aug 2019 09:06:02 +0000
From:   chengzhihao <chengzhihao1@...wei.com>
To:     "richard@....at" <richard@....at>,
        "zhangyi (F)" <yi.zhang@...wei.com>
CC:     "linux-mtd@...ts.infradead.org" <linux-mtd@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: 答复: [RFC] ubi: ubi_wl_get_peb: Replace a limited number of attempts with polling while getting PEB

I don't quite understand why a limited number of attempts have been made to get a free PEB in ubi_wl_get_peb (in fastmap-wl.c). I proposed this PATCH with reference to the implementation of ubi_wl_get_peb (in wl.c). As far as I know, getting PEB by polling probably won't fall into soft-lockup.
ubi_update_fastmap may add new tasks (including erase task or wl taskk, wl tasks generally do not generate additional free PEBs) to ubi->works, and produce_free_peb will eventually complete all tasks in ubi->works or obtain an free PEB that can be filled into pool.

-
Cheng zhihao

-----邮件原件-----
发件人: chengzhihao 
发送时间: 2019年8月1日 17:08
收件人: richard@....at; zhangyi (F) <yi.zhang@...wei.com>
抄送: linux-mtd@...ts.infradead.org; linux-kernel@...r.kernel.org; chengzhihao <chengzhihao1@...wei.com>
主题: [RFC] ubi: ubi_wl_get_peb: Replace a limited number of attempts with polling while getting PEB

Running pressure test io_paral (A pressure ubi test in mtd-utils) on an UBI device with fewer PEBs (fastmap enabled) may cause ENOSPC errors and make UBI device read-only, but there are still free PEBs on the UBI device. This problem can be easily reproduced by performing the following steps on a 2-core machine:
  $ modprobe nandsim first_id_byte=0x20 second_id_byte=0x33 parts=80
  $ modprobe ubi mtd="0,0" fm_autoconvert
  $ ./io_paral /dev/ubi0

We may see the following verbose:
(output)
  [io_paral] update_volume():105: function write() failed with error 30
  (Read-only file system)
  [io_paral] update_volume():108: failed to write 380 bytes at offset
  95920 of volume 2
  [io_paral] update_volume():109: update: 97088 bytes
  [io_paral] write_thread():227: function pwrite() failed with error 28
  (No space left on device)
  [io_paral] write_thread():229: cannot write 15872 bytes to offs 31744,
  wrote -1
(dmesg)
  ubi0 error: ubi_wl_get_peb [ubi]: Unable to get a free PEB from user WL
  pool
  ubi0 warning: ubi_eba_write_leb [ubi]: switch to read-only mode
  ubi0 error: ubi_io_write [ubi]: read-only mode
  CPU: 0 PID: 2027 Comm: io_paral Not tainted 5.3.0-rc2-00001-g5986cd0 #9
  ubi0 warning: try_write_vid_and_data [ubi]: failed to write VID header
  to LEB 2:5, PEB 18
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0
  -0-ga698c8995f-prebuilt.qemu.org 04/01/2014
  Call Trace:
   dump_stack+0x85/0xba
   ubi_eba_write_leb+0xa1e/0xa40 [ubi]
   vol_cdev_write+0x307/0x520 [ubi]
  ubi0 error: vol_cdev_write [ubi]: cannot accept more 380 bytes of data,
  error -30
   vfs_write+0xfa/0x280
   ksys_pwrite64+0xc5/0xe0
   __x64_sys_pwrite64+0x22/0x30
   do_syscall_64+0xbf/0x440

In function ubi_wl_get_peb, the operation of filling the pool
(ubi_update_fastmap) with free PEBs and fetching a free PEB from the pool is not atomic. After thread A filling the pool with free PEB, free PEB may be taken away by thread B. When thread A checks the expression again, the condition is still unsatisfactory. At this time, there may still be free PEBs on UBI that can be filled into the pool.
So, ubi_wl_get_peb (in fastmap-wil.c) should be implemented to obtain a free PEB by polling method. The polling exit condition is that there is no free PEBs on UBI, no free PEBs in pool, and ubi->works_count is 0.

Signed-off-by: Zhihao Cheng <chengzhihao1@...wei.com>
---
 drivers/mtd/ubi/fastmap-wl.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/mtd/ubi/fastmap-wl.c b/drivers/mtd/ubi/fastmap-wl.c index d9e2e3a..c5512cf 100644
--- a/drivers/mtd/ubi/fastmap-wl.c
+++ b/drivers/mtd/ubi/fastmap-wl.c
@@ -196,7 +196,7 @@ static int produce_free_peb(struct ubi_device *ubi)
  */
 int ubi_wl_get_peb(struct ubi_device *ubi)  {
-	int ret, retried = 0;
+	int ret;
 	struct ubi_fm_pool *pool = &ubi->fm_pool;
 	struct ubi_fm_pool *wl_pool = &ubi->fm_wl_pool;

@@ -220,13 +220,14 @@ int ubi_wl_get_peb(struct ubi_device *ubi)
 	}

 	if (pool->used == pool->size) {
-		spin_unlock(&ubi->wl_lock);
-		if (retried) {
+		if (!ubi->free.rb_node && ubi->works_count == 0) {
 			ubi_err(ubi, "Unable to get a free PEB from user WL pool");
+			ubi_assert(list_empty(&ubi->works));
+			spin_unlock(&ubi->wl_lock);
 			ret = -ENOSPC;
 			goto out;
 		}
-		retried = 1;
+		spin_unlock(&ubi->wl_lock);
 		up_read(&ubi->fm_eba_sem);
 		ret = produce_free_peb(ubi);
 		if (ret < 0) {
--
2.7.4