ext4 创建共享xattr触发jbd2断言'J_ASSERT_JH(jh, record == NULL)'失败

【标题描述】ext4 创建共享xattr触发jbd2断言'J_ASSERT_JH(jh, record == NULL)'失败
【环境信息】
NA
软件信息：
openeuler-1.0-lts
【问题复现步骤】
1. 打入延时补丁diff
2. 编译执行a.c
出现概率(是否必现，概率性错误)必现
【预期结果】
jbd2断言失败，内核PANIC
【实际结果】
```
[   39.129447] block 8871
[   39.548612] YY bb
[   39.549552] CNM
[   39.550364] jbd2_journal_cancel_revoke: find revoke 8871 wait (need_cancel 0 did_revoke 0)
[   40.548801] release 8871
[   40.550018] remove mb
[   40.550975] jbd2_journal_revoke: insert revoke 8871
[   41.566245] ------------[ cut here ]------------
[   41.568398] kernel BUG at fs/jbd2/revoke.c:469!
[   41.569534] invalid opcode: 0000 [#1] SMP KASAN PTI
[   41.570665] CPU: 0 PID: 2529 Comm: bb Not tainted 4.19.90+ #93
[   41.571970] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc34
[   41.575031] RIP: 0010:jbd2_journal_cancel_revoke+0x402/0x580
[   41.576351] Code: d4 e0 85 ff 48 39 dd 74 0a e8 ca e0 85 ff f0 80 65 02 ef e8 c0 e0 85 ff 48 89 ef e8 a8 dc d0 ff e9 0a ff ff ff e8 ae e5
[   41.579779] RSP: 0018:ffff88810bd17428 EFLAGS: 00010293
[   41.580737] RAX: ffff888113775700 RBX: ffff888115d49dc8 RCX: ffffffffb4063dc2
[   41.583335] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888113950898
[   41.584560] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffed10230a7c38
[   41.585762] R10: ffffed10230a7c37 R11: ffff88811853e1bb R12: ffff88811853dd80
[   41.590445] R13: ffff888115d49de0 R14: 0000000000000000 R15: 00000000000022a7
[   41.591605] FS:  00007f3b80fe8700(0000) GS:ffff8881ed200000(0000) knlGS:0000000000000000
[   41.593111] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   41.594296] CR2: 00007f605d337770 CR3: 0000000119fc6000 CR4: 00000000000006f0
[   41.595510] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   41.596722] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   41.597919] Call Trace:
[   41.598381]  do_get_write_access+0x7d7/0xec0
[   41.599118]  jbd2_journal_get_write_access+0x12c/0x190
[   41.603417]  __ext4_journal_get_write_access+0x183/0x2b0
[   41.604397]  ext4_xattr_block_set.cold+0x36a/0xda2
[   41.605230]  ? ext4_xattr_inode_array_free.part.0+0xc0/0xc0
[   41.606193]  ? ext4_xattr_inode_lookup_create+0x1180/0x1180
[   41.607152]  ? jbd2_journal_put_journal_head+0x8d/0x492
[   41.608066]  ? ext4_xattr_ibody_inline_set+0x262/0x360
[   41.608950]  ext4_xattr_set_handle+0x9f9/0x10d0
[   41.609738]  ? ext4_xattr_move_to_block+0x740/0x740
[   41.610570]  ? stop_this_handle+0x590/0x590
[   41.611272]  ? kasan_kmalloc+0x81/0xc0
[   41.611899]  ? __ext4_journal_start_sb+0xd8/0x2d0
[   41.612703]  ? __ext4_journal_start_sb+0xe1/0x2d0
[   41.613505]  ? ext4_xattr_set+0x20a/0x2c0
[   41.617480]  ext4_xattr_set+0x132/0x2c0
[   41.618155]  ? ext4_xattr_set_credits+0x200/0x200
[   41.618964]  ? kasan_kmalloc.part.0+0xbe/0xe0
[   41.619707]  ? ext4_xattr_user_list+0xa0/0xa0
[   41.620469]  ext4_xattr_user_set+0xae/0xf0
[   41.621179]  __vfs_setxattr+0xfb/0x160
[   41.621814]  ? xattr_resolve_name+0x370/0x370
[   41.622555]  ? evm_protect_xattr.isra.0+0x6f/0x390
[   41.623365]  __vfs_setxattr_noperm+0x102/0x3d0
[   41.624101]  __vfs_setxattr_locked+0x155/0x250
[   41.624866]  vfs_setxattr+0xed/0x270
[   41.625483]  ? __vfs_setxattr_locked+0x250/0x250
[   41.626271]  setxattr+0x1c1/0x330
[   41.626836]  ? vfs_setxattr+0x270/0x270
[   41.627503]  ? perf_event_comm+0x1b3/0x260
[   41.628220]  ? proc_comm_connector+0x17b/0x1e0
[   41.628970]  ? __fget+0x273/0x370
[   41.629556]  ? do_dup2+0x3d0/0x3d0
[   41.630172]  ? __se_sys_prctl+0x138/0xcc0
[   41.630864]  ? mnt_clone_write+0xb6/0x100
[   41.631581]  ? __mnt_want_write_file+0x9c/0xc0
[   41.632354]  __x64_sys_fsetxattr+0x1d0/0x270
[   41.633092]  do_syscall_64+0x11b/0xcf0
[   41.633751]  ? __switch_to_asm+0x41/0x70
[   41.634433]  ? __switch_to_asm+0x35/0x70
[   41.635101]  ? __switch_to_asm+0x41/0x70
[   41.635784]  ? syscall_return_slowpath+0x210/0x210
[   41.636821]  ? __switch_to_asm+0x41/0x70
[   41.637498]  ? __switch_to_asm+0x35/0x70
[   41.638163]  ? __switch_to_asm+0x41/0x70
[   41.638840]  ? __switch_to_asm+0x35/0x70
[   41.639507]  ? __switch_to_asm+0x41/0x70
[   41.640181]  ? finish_task_switch+0x1be/0x780
[   41.640902]  ? __switch_to_asm+0x35/0x70
[   41.641680]  ? __switch_to_asm+0x41/0x70
[   41.645782]  ? __switch_to_asm+0x35/0x70
[   41.646477]  ? recalc_sigpending_tsk+0xf5/0x150
[   41.647263]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   41.648117] RIP: 0033:0x7f3b810f822a
[   41.648757] Code: 48 8b 0d 61 fc 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 be 00 00 08
[   41.658012] RSP: 002b:00007f3b80fe7f28 EFLAGS: 00000217 ORIG_RAX: 00000000000000be
[   41.659474] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3b810f822a
[   41.660714] RDX: 0000000000400ac8 RSI: 0000000000400b3a RDI: 0000000000000004
[   41.662081] RBP: 00007f3b80fe7f40 R08: 0000000000000001 R09: 00007f3b80fe8700
[   41.663573] R10: 0000000000000071 R11: 0000000000000217 R12: 00007f3b80fe8000
[   41.664738] R13: 0000000000000000 R14: 00007ffe097e42f0 R15: 00007f3b80fe89c0
[   41.666117] Modules linked in:
[   41.666749] ---[ end trace 2b69d0c5f9f598fb ]---
[   41.667554] RIP: 0010:jbd2_journal_cancel_revoke+0x402/0x580
[   41.668518] Code: d4 e0 85 ff 48 39 dd 74 0a e8 ca e0 85 ff f0 80 65 02 ef e8 c0 e0 85 ff 48 89 ef e8 a8 dc d0 ff e9 0a ff ff ff e8 ae e5
[   41.671913] RSP: 0018:ffff88810bd17428 EFLAGS: 00010293
[   41.672798] RAX: ffff888113775700 RBX: ffff888115d49dc8 RCX: ffffffffb4063dc2
[   41.674011] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888113950898
[   41.675216] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffed10230a7c38
[   41.676400] R10: ffffed10230a7c37 R11: ffff88811853e1bb R12: ffff88811853dd80
[   41.677657] R13: ffff888115d49de0 R14: 0000000000000000 R15: 00000000000022a7
[   41.678918] FS:  00007f3b80fe8700(0000) GS:ffff8881ed200000(0000) knlGS:0000000000000000
[   41.680291] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   41.681265] CR2: 00007f605d337770 CR3: 0000000119fc6000 CR4: 00000000000006f0
[   41.682518] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   41.683734] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
```
【附件信息】
diff
```
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index ffaf31584c0e..5f18ebdf255d 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1221,6 +1221,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
  * Release the xattr block BH: If the reference count is > 1, decrement it;
  * otherwise free the block.
  */
+#include <linux/delay.h>
 static void
 ext4_xattr_release_block(handle_t *handle, struct inode *inode,
 			 struct buffer_head *bh,
@@ -1236,6 +1237,10 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
 	if (error)
 		goto out;
 
+	if (!strcmp(current->comm, "aa")) {
+		//msleep(500);
+		pr_err("release %llu\n", bh->b_blocknr);
+	}
 	lock_buffer(bh);
 	hash = le32_to_cpu(BHDR(bh)->h_hash);
 	ref = le32_to_cpu(BHDR(bh)->h_refcount);
@@ -1250,6 +1255,8 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
 					      bh->b_blocknr);
 		get_bh(bh);
 		unlock_buffer(bh);
+		if (!strcmp(current->comm, "aa"))
+			pr_err("remove mb\n");
 
 		if (ext4_has_feature_ea_inode(inode->i_sb))
 			ext4_xattr_inode_dec_ref_all(handle, inode, bh,
@@ -1975,10 +1982,12 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
 						     &ce);
 		if (new_bh) {
 			/* We found an identical block in the cache. */
-			if (new_bh == bs->bh)
+			if (new_bh == bs->bh) {
+				pr_err("EE\n");
 				ea_bdebug(new_bh, "keeping");
-			else {
+			} else {
 				u32 ref;
+				pr_err("YY %s\n", current->comm);
 
 				WARN_ON_ONCE(dquot_initialize_needed(inode));
 
@@ -2041,6 +2050,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
 			ce = NULL;
 		} else if (bs->bh && s->base == bs->bh->b_data) {
 			/* We were modifying this block in-place. */
+			pr_err("11\n");
 			ea_bdebug(bs->bh, "keeping this block");
 			ext4_xattr_block_cache_insert(ea_block_cache, bs->bh);
 			new_bh = bs->bh;
@@ -2069,6 +2079,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
 			ea_idebug(inode, "creating block %llu",
 				  (unsigned long long)block);
 
+			pr_err("block %llu\n", block);
 			new_bh = sb_getblk(sb, block);
 			if (unlikely(!new_bh)) {
 				error = -ENOMEM;
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index fa608788b93d..050cc17d151b 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -323,6 +323,7 @@ void jbd2_journal_destroy_revoke(journal_t *journal)
  * by one.
  */
 
+#include <linux/delay.h>
 int jbd2_journal_revoke(handle_t *handle, unsigned long long blocknr,
 		   struct buffer_head *bh_in)
 {
@@ -376,6 +377,10 @@ int jbd2_journal_revoke(handle_t *handle, unsigned long long blocknr,
 			brelse(bh);
 		return -EIO;
 	}
+	if (!strcmp(current->comm, "aa")) {
+		pr_err("%s: insert revoke %llu\n", __func__, bh->b_blocknr);
+		msleep(1000);
+	}
 	/* We really ought not ever to revoke twice in a row without
            first having the revoke cancelled: it's illegal to free a
            block twice without allocating it in between! */
@@ -456,6 +461,10 @@ int jbd2_journal_cancel_revoke(handle_t *handle, struct journal_head *jh)
 
 #ifdef JBD2_EXPENSIVE_CHECKING
 	/* There better not be one left behind by now! */
+	if (!strcmp(current->comm, "bb") && bh->b_blocknr > 8000) {
+		pr_err("%s: find revoke %llu wait (need_cancel %d did_revoke %d)\n", __func__, bh->b_blocknr, need_cancel, did_revoke);
+		msleep(2000);
+	}
 	record = find_revoke_record(journal, bh->b_blocknr);
 	J_ASSERT_JH(jh, record == NULL);
 #endif
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index f56be34564e7..34d64c235593 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1156,8 +1156,11 @@ int jbd2_journal_get_write_access(handle_t *handle, struct buffer_head *bh)
 	if (is_handle_aborted(handle))
 		return -EROFS;
 
-	if (jbd2_write_access_granted(handle, bh, false))
+	if (jbd2_write_access_granted(handle, bh, false)) {
+		if (!strcmp(current->comm, "bb"))
+			pr_err("CNM\n");
 		return 0;
+	}
 
 	jh = jbd2_journal_add_journal_head(bh);
 	/* We do not want to get caught playing with fields which the

```
a.c
```
#define _GNU_SOURCE             /* See feature_test_macros(7) */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mount.h>
#include <getopt.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/xattr.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <errno.h>
#include <string.h>
#include <linux/reboot.h>
#include <arpa/inet.h>
#include <pthread.h>
#include <grp.h>
#include <sys/prctl.h>
#include <linux/fs.h>
#include <signal.h>
#include <sched.h>
#include <sys/wait.h>
#include <sys/mman.h>
#include <linux/perf_event.h>
#include <linux/bpf.h>
#include <sys/sysinfo.h>
#include <sys/epoll.h>
#include <asm/unistd.h>
#include <sys/time.h>
#include <sys/sendfile.h>
#include <stdarg.h>

#if 0
int main(void)
{
	int in, out, ret;
	in = open("/dev/ram0", 0);
	out = open("/root/file", O_RDWR);
	if (in < 0 || out < 0) {
		perror("open fail");
		return 0;
	}

ret = sendfile(out, in, NULL, 8192);
	if (ret < 0)
		perror("send fail");

close(in);
	close(out);
	return 0;
}
#endif

#define VALUE "11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"

int fd, fd2;

static void *func(void *arg)
{
	prctl(PR_SET_NAME, "bb");
	if (fsetxattr(fd2, "user.name", VALUE, strlen(VALUE), XATTR_CREATE) < 0)
		perror("setxattr fail");
	pthread_exit(0);
}

int main(void)
{
	void *res;
	pthread_t tid;
	system("umount /root/temp");
	system("mkfs.ext4 -F /dev/sdb");
	system("mount /dev/sdb /root/temp");
	system("rm -f /root/temp/file");
	system("rm -f /root/temp/file2");
	system("touch /root/temp/file");
	system("touch /root/temp/file2");
	fd = open("/root/temp/file", O_RDWR);
	fd2 = open("/root/temp/file2", O_RDWR);
	if (fd < 0 || fd2 < 0) {
		perror("open fail");
		return 0;
	}

if (fsetxattr(fd, "user.name", VALUE, strlen(VALUE), XATTR_CREATE) < 0) {
		perror("setxattr fail");
		return 0;
	}
	sync();

if (pthread_create(&tid, NULL, func, NULL) < 0) {
		perror("cannot create thread");
		return 0;
	}

sleep(1);
	if (fremovexattr(fd, "user.name") < 0) {
		perror("remove xattr fail");
		return 0;
	}

pthread_join(tid, &res);
	printf("OK\n");

return 0;
}
```

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (1)

GVPopenEuler/kernelClosed

Content Risk Flag