linux-kernel - Re: [PATCH v3] f2fs: fix inconsistent dirty state of atomic file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2e51d9c8-840d-486f-a1eb-f18500d2f252@kernel.org>
Date: Fri, 24 Jan 2025 15:30:43 +0800
From: Chao Yu <chao@...nel.org>
To: Jianan Huang <huangjianan@...omi.com>,
 linux-f2fs-devel@...ts.sourceforge.net, jaegeuk@...nel.org
Cc: chao@...nel.org, linux-kernel@...r.kernel.org, daehojeong@...gle.com,
 heyunlei@...omi.com, wanghui33@...omi.com, yudongbin@...omi.com,
 jnhuang95@...il.com
Subject: Re: [PATCH v3] f2fs: fix inconsistent dirty state of atomic file

On 1/24/25 13:57, Jianan Huang wrote:
> When testing the atomic write fix patches, the f2fs_bug_on was
> triggered as below:
> 
> ------------[ cut here ]------------
> kernel BUG at fs/f2fs/inode.c:935!
> Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
> CPU: 3 UID: 0 PID: 257 Comm: bash Not tainted 6.13.0-rc1-00033-gc283a70d3497 #5
> RIP: 0010:f2fs_evict_inode+0x50f/0x520
> Call Trace:
>  <TASK>
>  ? __die_body+0x65/0xb0
>  ? die+0x9f/0xc0
>  ? do_trap+0xa1/0x170
>  ? f2fs_evict_inode+0x50f/0x520
>  ? f2fs_evict_inode+0x50f/0x520
>  ? handle_invalid_op+0x65/0x80
>  ? f2fs_evict_inode+0x50f/0x520
>  ? exc_invalid_op+0x39/0x50
>  ? asm_exc_invalid_op+0x1a/0x20
>  ? __pfx_f2fs_get_dquots+0x10/0x10
>  ? f2fs_evict_inode+0x50f/0x520
>  ? f2fs_evict_inode+0x2e5/0x520
>  evict+0x186/0x2f0
>  prune_icache_sb+0x75/0xb0
>  super_cache_scan+0x1a8/0x200
>  do_shrink_slab+0x163/0x320
>  shrink_slab+0x2fc/0x470
>  drop_slab+0x82/0xf0
>  drop_caches_sysctl_handler+0x4e/0xb0
>  proc_sys_call_handler+0x183/0x280
>  vfs_write+0x36d/0x450
>  ksys_write+0x68/0xd0
>  do_syscall_64+0xc8/0x1a0
>  ? arch_exit_to_user_mode_prepare+0x11/0x60
>  ? irqentry_exit_to_user_mode+0x7e/0xa0
> 
> The root cause is: f2fs uses FI_ATOMIC_DIRTIED to indicate dirty
> atomic files during commit. If the inode is dirtied during commit,
> such as by f2fs_i_pino_write, the vfs inode keeps clean and the
> f2fs inode is set to FI_DIRTY_INODE. The FI_DIRTY_INODE flag cann't
> be cleared by write_inode later due to the clean vfs inode. Finally,
> f2fs_bug_on is triggered due to this inconsistent state when evict.
> 
> To reproduce this situation:
> - fd = open("/mnt/test.db", O_WRONLY)
> - ioctl(fd, F2FS_IOC_START_ATOMIC_WRITE)
> - mv /mnt/test.db /mnt/test1.db
> - ioctl(fd, F2FS_IOC_COMMIT_ATOMIC_WRITE)
> - echo 3 > /proc/sys/vm/drop_caches
> 
> To fix this problem, clear FI_DIRTY_INODE after commit, then
> f2fs_mark_inode_dirty_sync will ensure a consistent dirty state.
> 
> Fixes: fccaa81de87e ("f2fs: prevent atomic file from being dirtied before commit")
> Signed-off-by: Yunlei He <heyunlei@...omi.com>
> Signed-off-by: Jianan Huang <huangjianan@...omi.com>

Reviewed-by: Chao Yu <chao@...nel.org>

Thanks,