linux-kernel - Re: [PATCH] dm verity fec: Expose corrected block count via status

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <074e1ecc-6690-1c22-0dba-454e191e1b6f@redhat.com>
Date: Wed, 5 Nov 2025 15:27:28 +0100 (CET)
From: Mikulas Patocka <mpatocka@...hat.com>
To: Shubhankar Mishra <shubhankarm@...gle.com>
cc: Alasdair Kergon <agk@...hat.com>, Mike Snitzer <snitzer@...nel.org>, 
    Jonathan Corbet <corbet@....net>, dm-devel@...ts.linux.dev, 
    linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org, 
    Eric Biggers <ebiggers@...gle.com>, 
    Sami Tolvanen <samitolvanen@...gle.com>, kernel-team@...roid.com
Subject: Re: [PATCH] dm verity fec: Expose corrected block count via status

Accepted, thanks.

Mikulas

On Wed, 5 Nov 2025, Shubhankar Mishra wrote:

> Enhance visibility into dm-verity Forward Error Correction (FEC)
> activity. While FEC can correct on-disk corruptions, the number of
> successful correction events is not readily exposed through a standard
> interface.
> 
> This change integrates FEC statistics into the verity target's
> .status handler for STATUSTYPE_INFO. The info output now
> includes count of corrected block by FEC.
> 
> The counter is a per-device instance atomic64_t, maintained within
> the struct dm_verity_fec, tracking blocks successfully repaired by FEC
> on this specific device instance since it was created.
> 
> This approach aligns with the standard Device Mapper mechanism for
> targets to report runtime information, as used by other targets like
> dm-integrity.
> 
> This patch also updates Documentation/admin-guide/device-mapper/verity.rst
> to reflect the new status information.
> 
> Tested:
>   Induced single-bit errors on a block device protected by dm-verity
>   with FEC on android phone. Confirmed 'dmctl status <device>' on Android
>   reports an incrementing 'fec_corrected_blocks' count after the
>   corrupted blocks were accessed.
> 
> Signed-off-by: Shubhankar Mishra <shubhankarm@...gle.com>
> ---
>  Documentation/admin-guide/device-mapper/verity.rst | 6 ++++--
>  drivers/md/dm-verity-fec.c                         | 4 +++-
>  drivers/md/dm-verity-fec.h                         | 1 +
>  drivers/md/dm-verity-target.c                      | 4 ++++
>  4 files changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/Documentation/admin-guide/device-mapper/verity.rst b/Documentation/admin-guide/device-mapper/verity.rst
> index 8c3f1f967a3c..3ecab1cff9c6 100644
> --- a/Documentation/admin-guide/device-mapper/verity.rst
> +++ b/Documentation/admin-guide/device-mapper/verity.rst
> @@ -236,8 +236,10 @@ is available at the cryptsetup project's wiki page
>  
>  Status
>  ======
> -V (for Valid) is returned if every check performed so far was valid.
> -If any check failed, C (for Corruption) is returned.
> +1. V (for Valid) is returned if every check performed so far was valid.
> +   If any check failed, C (for Corruption) is returned.
> +2. Number of corrected blocks by Forward Error Correction.
> +   '-' if Forward Error Correction is not enabled.
>  
>  Example
>  =======
> diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
> index 301a9c01bf86..d792eaed0792 100644
> --- a/drivers/md/dm-verity-fec.c
> +++ b/drivers/md/dm-verity-fec.c
> @@ -177,9 +177,11 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_io *io,
>  	if (r < 0 && neras)
>  		DMERR_LIMIT("%s: FEC %llu: failed to correct: %d",
>  			    v->data_dev->name, (unsigned long long)rsb, r);
> -	else if (r > 0)
> +	else if (r > 0) {
>  		DMWARN_LIMIT("%s: FEC %llu: corrected %d errors",
>  			     v->data_dev->name, (unsigned long long)rsb, r);
> +		atomic64_inc(&v->fec->corrected);
> +	}
>  
>  	return r;
>  }
> diff --git a/drivers/md/dm-verity-fec.h b/drivers/md/dm-verity-fec.h
> index a6689cdc489d..dd55037377b6 100644
> --- a/drivers/md/dm-verity-fec.h
> +++ b/drivers/md/dm-verity-fec.h
> @@ -48,6 +48,7 @@ struct dm_verity_fec {
>  	mempool_t extra_pool;	/* mempool for extra buffers */
>  	mempool_t output_pool;	/* mempool for output */
>  	struct kmem_cache *cache;	/* cache for buffers */
> +	atomic64_t corrected; /* corrected errors */
>  };
>  
>  /* per-bio data */
> diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
> index bf0aee73b074..52a0e052a5e8 100644
> --- a/drivers/md/dm-verity-target.c
> +++ b/drivers/md/dm-verity-target.c
> @@ -848,6 +848,10 @@ static void verity_status(struct dm_target *ti, status_type_t type,
>  	switch (type) {
>  	case STATUSTYPE_INFO:
>  		DMEMIT("%c", v->hash_failed ? 'C' : 'V');
> +		if (verity_fec_is_enabled(v))
> +			DMEMIT(" %lld", atomic64_read(&v->fec->corrected));
> +		else
> +			DMEMIT(" -");
>  		break;
>  	case STATUSTYPE_TABLE:
>  		DMEMIT("%u %s %s %u %u %llu %llu %s ",
> -- 
> 2.51.2.1006.ga50a493c49-goog
>