| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <def71b03-f412-5277-d1ba-1ae145ed0150@kernel.org>
Date: Fri, 30 Sep 2022 07:08:13 +0800
From: Chao Yu <chao@...nel.org>
To: Jaegeuk Kim <jaegeuk@...nel.org>
Cc: linux-f2fs-devel@...ts.sourceforge.net,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 3/3] f2fs: support errors=remount-ro|continue|panic
mountoption
On 2022/9/30 2:31, Jaegeuk Kim wrote:
> On 09/29, Chao Yu wrote:
>> This patch supports errors=remount-ro|continue|panic mount option.
>>
>> Signed-off-by: Chao Yu <chao@...nel.org>
>> ---
>> v2:
>> - fix to load sb.s_stop_reason during fill_super().
>> Documentation/filesystems/f2fs.rst | 4 +
>> fs/f2fs/checkpoint.c | 7 +-
>> fs/f2fs/f2fs.h | 18 ++++-
>> fs/f2fs/super.c | 115 ++++++++++++++++++++++++++++-
>> 4 files changed, 133 insertions(+), 11 deletions(-)
>>
>> diff --git a/Documentation/filesystems/f2fs.rst b/Documentation/filesystems/f2fs.rst
>> index d0c09663dae8..6aa14e03f337 100644
>> --- a/Documentation/filesystems/f2fs.rst
>> +++ b/Documentation/filesystems/f2fs.rst
>> @@ -341,6 +341,10 @@ memory=%s Control memory mode. This supports "normal" and "low" modes.
>> Because of the nature of low memory devices, in this mode, f2fs
>> will try to save memory sometimes by sacrificing performance.
>> "normal" mode is the default mode and same as before.
>> +errors=%s Specify f2fs behavior on critical errors. This supports modes:
>> + "panic", "continue" and "remount-ro", respectively, triggers
>> + panic immediately, continue without doing anything, or remount
>> + the partition in read-only mode (default behavior).
>> ======================== ============================================================
>>
>> Debugfs Entries
>> diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
>> index 0c82dae082aa..109e96c15b84 100644
>> --- a/fs/f2fs/checkpoint.c
>> +++ b/fs/f2fs/checkpoint.c
>> @@ -30,12 +30,9 @@ void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi, bool end_io,
>> unsigned char reason)
>> {
>> f2fs_build_fault_attr(sbi, 0, 0);
>> - set_ckpt_flags(sbi, CP_ERROR_FLAG);
>> - if (!end_io) {
>> + if (!end_io)
>> f2fs_flush_merged_writes(sbi);
>> -
>> - f2fs_handle_stop(sbi, reason);
>> - }
>> + f2fs_handle_critical_error(sbi, reason, end_io);
>> }
>>
>> /*
>> diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
>> index 2ed00111a399..254f7f153477 100644
>> --- a/fs/f2fs/f2fs.h
>> +++ b/fs/f2fs/f2fs.h
>> @@ -160,6 +160,7 @@ struct f2fs_mount_info {
>> int fs_mode; /* fs mode: LFS or ADAPTIVE */
>> int bggc_mode; /* bggc mode: off, on or sync */
>> int memory_mode; /* memory mode */
>> + int errors; /* errors parameter */
>> int discard_unit; /*
>> * discard command's offset/size should
>> * be aligned to this unit: block,
>> @@ -1382,7 +1383,11 @@ enum {
>> MEMORY_MODE_LOW, /* memory mode for low memry devices */
>> };
>>
>> -
>> +enum errors_option {
>> + MOUNT_ERRORS_READONLY, /* remount fs ro on errors */
>> + MOUNT_ERRORS_CONTINUE, /* continue on errors */
>> + MOUNT_ERRORS_PANIC, /* panic on errors */
>> +};
>>
>> static inline int f2fs_test_bit(unsigned int nr, char *addr);
>> static inline void f2fs_set_bit(unsigned int nr, char *addr);
>> @@ -1818,7 +1823,13 @@ struct f2fs_sb_info {
>>
>> struct workqueue_struct *post_read_wq; /* post read workqueue */
>>
>> - unsigned char errors[MAX_F2FS_ERRORS]; /* error flags */
>> + /*
>> + * If we are in irq context, let's update error information into
>> + * on-disk superblock in the work.
>> + */
>> + struct work_struct s_error_work;
>> + unsigned char errors[MAX_F2FS_ERRORS]; /* error flags */
>> + unsigned char stop_reason[MAX_STOP_REASON]; /* stop reason */
>> spinlock_t error_lock; /* protect errors array */
>> bool error_dirty; /* errors of sb is dirty */
>>
>> @@ -3563,7 +3574,8 @@ int f2fs_enable_quota_files(struct f2fs_sb_info *sbi, bool rdonly);
>> int f2fs_quota_sync(struct super_block *sb, int type);
>> loff_t max_file_blocks(struct inode *inode);
>> void f2fs_quota_off_umount(struct super_block *sb);
>> -void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason);
>> +void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
>> + bool irq_context);
>> void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error);
>> int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover);
>> int f2fs_sync_fs(struct super_block *sb, int sync);
>> diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
>> index ee0a5a17ba39..60bd0344f573 100644
>> --- a/fs/f2fs/super.c
>> +++ b/fs/f2fs/super.c
>> @@ -161,6 +161,7 @@ enum {
>> Opt_nogc_merge,
>> Opt_discard_unit,
>> Opt_memory_mode,
>> + Opt_errors,
>> Opt_err,
>> };
>>
>> @@ -238,6 +239,7 @@ static match_table_t f2fs_tokens = {
>> {Opt_nogc_merge, "nogc_merge"},
>> {Opt_discard_unit, "discard_unit=%s"},
>> {Opt_memory_mode, "memory=%s"},
>> + {Opt_errors, "errors=%s"},
>> {Opt_err, NULL},
>> };
>>
>> @@ -1253,6 +1255,25 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount)
>> }
>> kfree(name);
>> break;
>> + case Opt_errors:
>> + name = match_strdup(&args[0]);
>> + if (!name)
>> + return -ENOMEM;
>> + if (!strcmp(name, "remount-ro")) {
>> + F2FS_OPTION(sbi).errors =
>> + MOUNT_ERRORS_READONLY;
>> + } else if (!strcmp(name, "continue")) {
>> + F2FS_OPTION(sbi).errors =
>> + MOUNT_ERRORS_CONTINUE;
>> + } else if (!strcmp(name, "panic")) {
>> + F2FS_OPTION(sbi).errors =
>> + MOUNT_ERRORS_PANIC;
>> + } else {
>> + kfree(name);
>> + return -EINVAL;
>> + }
>> + kfree(name);
>> + break;
>> default:
>> f2fs_err(sbi, "Unrecognized mount option \"%s\" or missing value",
>> p);
>> @@ -2031,6 +2052,13 @@ static int f2fs_show_options(struct seq_file *seq, struct dentry *root)
>> else if (F2FS_OPTION(sbi).memory_mode == MEMORY_MODE_LOW)
>> seq_printf(seq, ",memory=%s", "low");
>>
>> + if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_READONLY)
>> + seq_printf(seq, ",errors=%s", "remount-ro");
>> + else if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_CONTINUE)
>> + seq_printf(seq, ",errors=%s", "continue");
>> + else if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_PANIC)
>> + seq_printf(seq, ",errors=%s", "panic");
>> +
>> return 0;
>> }
>>
>> @@ -2053,6 +2081,7 @@ static void default_options(struct f2fs_sb_info *sbi)
>> F2FS_OPTION(sbi).compress_mode = COMPR_MODE_FS;
>> F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_ON;
>> F2FS_OPTION(sbi).memory_mode = MEMORY_MODE_NORMAL;
>> + F2FS_OPTION(sbi).errors = MOUNT_ERRORS_READONLY;
>>
>> sbi->sb->s_flags &= ~SB_INLINECRYPT;
>>
>> @@ -3846,7 +3875,16 @@ int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover)
>> return err;
>> }
>>
>> -void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason)
>> +static void save_stop_reason(struct f2fs_sb_info *sbi, unsigned char reason)
>> +
>> +{
>> + spin_lock(&sbi->error_lock);
>> + if (sbi->stop_reason[reason] < ((1 << BITS_PER_BYTE) - 1))
>> + sbi->stop_reason[reason]++;
>> + spin_unlock(&sbi->error_lock);
>> +}
>> +
>> +void f2fs_record_stop_reason(struct f2fs_sb_info *sbi, unsigned char reason)
>>
>> {
>> struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
>> @@ -3854,8 +3892,9 @@ void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason)
>>
>> f2fs_down_write(&sbi->sb_lock);
>>
>> - if (raw_super->s_stop_reason[reason] < ((1 << BITS_PER_BYTE) - 1))
>> - raw_super->s_stop_reason[reason]++;
>> + spin_lock(&sbi->error_lock);
>> + memcpy(raw_super->s_stop_reason, sbi->stop_reason, MAX_STOP_REASON);
>> + spin_unlock(&sbi->error_lock);
>>
>> err = f2fs_commit_super(sbi, false);
>> if (err)
>> @@ -3909,6 +3948,74 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
>> f2fs_up_write(&sbi->sb_lock);
>> }
>>
>> +static bool system_going_down(void)
>> +{
>> + return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF
>> + || system_state == SYSTEM_RESTART;
>> +}
>> +
>> +void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
>> + bool irq_context)
>> +{
>> + struct super_block *sb = sbi->sb;
>> + bool force_ro = reason == STOP_CP_REASON_SHUTDOWN;
>
> Can we check f2fs stopped checkpoint intentionally and use it here?
Sorry, I didn't get it.... :(
You mean we should do the check in other place? or should check all reason here?
Thanks,
>
>> + bool continue_fs = !force_ro &&
>> + F2FS_OPTION(sbi).errors == MOUNT_ERRORS_CONTINUE;
>> +
>> + if (!continue_fs && !sb_rdonly(sb))
>> + set_ckpt_flags(sbi, CP_ERROR_FLAG);
>> +
>> + if (!bdev_read_only(sb->s_bdev)) {
>> + save_stop_reason(sbi, reason);
>> +
>> + if (irq_context)
>> + schedule_work(&sbi->s_error_work);
>> + else
>> + f2fs_record_stop_reason(sbi, reason);
>> + }
>> +
>> + /*
>> + * We force ERRORS_RO behavior when system is rebooting. Otherwise we
>> + * could panic during 'reboot -f' as the underlying device got already
>> + * disabled.
>> + */
>> + if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_PANIC &&
>> + !force_ro && !system_going_down())
>> + panic("F2FS-fs (device %s): panic forced after error\n",
>> + sb->s_id);
>> +
>> + /* continue filesystem operators if errors=continue */
>> + if (continue_fs || sb_rdonly(sb))
>> + return;
>> +
>> + f2fs_warn(sbi, "Remounting filesystem read-only");
>> + /*
>> + * Make sure updated value of ->s_mount_flags will be visible before
>> + * ->s_flags update
>> + */
>> + smp_wmb();
>> + sb->s_flags |= SB_RDONLY;
>> +
>> + f2fs_stop_gc_thread(sbi);
>> + f2fs_stop_discard_thread(sbi);
>> +}
>> +
>> +static void flush_error_work(struct work_struct *work)
>> +{
>> + struct f2fs_sb_info *sbi = container_of(work,
>> + struct f2fs_sb_info, s_error_work);
>> + int ret;
>> +
>> + if (sb_rdonly(sbi->sb))
>> + return;
>> +
>> + f2fs_down_write(&sbi->sb_lock);
>> + ret = f2fs_commit_super(sbi, false);
>> + f2fs_up_write(&sbi->sb_lock);
>> + if (ret)
>> + f2fs_err(sbi, "flush_error_work() fails to commit superblock ret:%d", ret);
>> +}
>> +
>> static int f2fs_scan_devices(struct f2fs_sb_info *sbi)
>> {
>> struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
>> @@ -4256,8 +4363,10 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent)
>> goto free_devices;
>> }
>>
>> + INIT_WORK(&sbi->s_error_work, flush_error_work);
>> spin_lock_init(&sbi->error_lock);
>> memcpy(sbi->errors, raw_super->s_errors, MAX_F2FS_ERRORS);
>> + memcpy(sbi->stop_reason, raw_super->s_stop_reason, MAX_STOP_REASON);
>>
>> sbi->total_valid_node_count =
>> le32_to_cpu(sbi->ckpt->valid_node_count);
>> --
>> 2.36.1
Powered by blists - more mailing lists