jb2: 提交EIO异常流程和dirty_meta并发触发J_ASSERT_JH(jh, jh->b_frozen_data == NULL)断言失败

【标题描述】jb2: 提交EIO异常流程和dirty_meta并发触发J_ASSERT_JH(jh, jh->b_frozen_data == NULL)断言失败
【环境信息】
NA
软件信息：
openeuler-1.0-lts
【问题复现步骤】
打入延时补丁diff
编译执行a.c
出现概率(是否必现，概率性错误)必现
【预期结果】
jbd2断言失败，内核PANIC
【实际结果】
```
[   24.766780] jbd2_journal_dirty_metadata: jh ffff88810b8a9bb0 already on trans ffff88810ed928c0
[   27.012690] jbd2_journal_dirty_metadata: jh ffff88810eca0bb0 already on trans ffff88810ed932c0
[   32.038416] jbd2_journal_dirty_metadata: jh ffff88810b8a9bb0 already on trans ffff888122cdf900
[   35.084120] jbd2_journal_dirty_metadata: jh ffff88810b8a9bb0 already on trans ffff88812600b2c0
[   35.119467] jbd2_journal_dirty_metadata: jh ffff8881256cddc0 already on trans ffff888106db3b80
[   35.175925] jbd2_journal_dirty_metadata: set jh ffff88810b8a9840 BJ_Metadata, trans ffff88810ed93040
[   35.178848] jbd2_journal_dirty_metadata: set jh ffff88810b8a92c0 BJ_Metadata, trans ffff88810ed93040
[   35.188011] jbd2_journal_commit_transaction: wait process jh ffff88810b8a9840 in trans ffff88810ed93040
[   35.192655] jbd2_journal_dirty_metadata: jh ffff88810b8a9bb0 already on trans ffff88812600b040
[   36.204101] do_get_write_access: set jh ffff88810b8a9840 frozen data, trans ffff88810ed93040
[   36.205256] jbd2_journal_dirty_metadata: jh ffff88810b8a9840 trans ffff88810ed93040 wait trans changed
[   37.194237] EXT4-fs (sda): shut down requested (2)
[   37.200644] Aborting journal on device sda-8.
[   37.221495] abort journal
[   37.246992] jbd2_journal_commit_transaction: wait done process jh ffff88810b8a9840 in trans ffff88810ed93040
[   37.263102] jbd2_journal_dirty_metadata: jh ffff88810b8a9840 trans ffff88812600ac80 wait done trans changed
[   37.266540] ------------[ cut here ]------------
[   37.268074] kernel BUG at fs/jbd2/transaction.c:1553!
[   37.269913] invalid opcode: 0000 [#1] SMP KASAN PTI
[   37.271548] CPU: 0 PID: 2530 Comm: unlink Not tainted 4.19.90+ #110
[   37.273547] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc34
[   37.275479] RIP: 0010:jbd2_journal_dirty_metadata+0x926/0x10d0
[   37.276403] Code: 38 00 0f 85 92 03 00 00 48 8b 03 a9 00 00 80 00 75 e1 e8 6d f8 86 ff f0 48 0f ba 2b 17 0f 83 61 f9 ff ff eb c9 e8 5a f4
[   37.279168] RSP: 0018:ffff888116d87af0 EFLAGS: 00010293
[   37.280013] RAX: ffff888108c9d700 RBX: ffff888122f22690 RCX: ffffffffb2452616
[   37.281079] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88810b8a9858
[   37.282119] RBP: ffff888106d28370 R08: 000000000000005f R09: ffffed103e604e09
[   37.283224] R10: ffffed103e604e08 R11: ffff8881f3027047 R12: ffff88810b8a9840
[   37.284834] R13: ffff88812600ac80 R14: 0000000000000000 R15: ffff88812600ac80
[   37.287178] FS:  00007f0d54ee94c0(0000) GS:ffff8881f3000000(0000) knlGS:0000000000000000
[   37.289749] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   37.291513] CR2: 00007fc4392aefc0 CR3: 0000000114264000 CR4: 00000000000006f0
[   37.293763] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   37.296066] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   37.297543] Call Trace:
[   37.297938]  __ext4_handle_dirty_metadata+0xe6/0x7f9
[   37.298601]  ? ext4_handle_dirty_dirent_node+0x217/0x2e0
[   37.299457]  ext4_delete_entry+0x303/0x460
[   37.300124]  ? ext4_generic_delete_entry+0x330/0x330
[   37.300884]  ? __ext4_journal_start_sb+0xd8/0x2d0
[   37.301638]  ? __ext4_journal_start_sb+0xe1/0x2d0
[   37.302338]  ? ext4_unlink+0x3a0/0xc60
[   37.302928]  ext4_unlink+0x498/0xc60
[   37.303460]  ? ext4_mkdir+0xc40/0xc40
[   37.303954]  ? may_delete+0x35d/0x640
[   37.304445]  vfs_unlink+0x23e/0x470
[   37.304979]  ? __lookup_hash+0x3b/0x180
[   37.305488]  do_unlinkat+0x337/0x5c0
[   37.305965]  ? __x64_sys_rmdir+0x40/0x40
[   37.306491]  ? strncpy_from_user+0x203/0x310
[   37.307106]  ? getname_flags+0x233/0x550
[   37.307695]  do_syscall_64+0x11b/0xcf0
[   37.308269]  ? syscall_return_slowpath+0x210/0x210
[   37.308984]  ? do_page_fault+0x56/0x2c0
[   37.309552]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
```
【附件信息】
diff
```
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 413bf3d2f784..df7ecad2260b 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -643,6 +643,7 @@ static int ext4_shutdown(struct super_block *sb, unsigned long arg)
 		set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags);
 		if (sbi->s_journal && !is_journal_aborted(sbi->s_journal))
 			jbd2_journal_abort(sbi->s_journal, -ESHUTDOWN);
+		pr_err("abort journal\n");
 		break;
 	default:
 		return -EINVAL;
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 98cfa73cb165..afab1d21b076 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -378,6 +378,9 @@ static void jbd2_block_tag_csum_set(journal_t *j, journal_block_tag_t *tag,
  * The primary function for committing a transaction to the log.  This
  * function is called by the journal thread to begin a complete commit.
  */
+#include <linux/delay.h>
+extern struct journal_head *g_jh;
+extern int g_wait;
 void jbd2_journal_commit_transaction(journal_t *journal)
 {
 	struct transaction_stats_s stats;
@@ -630,6 +633,12 @@ void jbd2_journal_commit_transaction(journal_t *journal)
 		/* If we're in abort mode, we just un-journal the buffer and
 		   release it. */
 
+		if (g_jh == jh) {
+			pr_err("%s: wait process jh %px in trans %px\n", __func__, jh, commit_transaction);
+			while (!is_journal_aborted(journal))
+				msleep(100);
+			pr_err("%s: wait done process jh %px in trans %px\n", __func__, jh, commit_transaction);
+		}
 		if (is_journal_aborted(journal)) {
 			clear_buffer_jbddirty(jh2bh(jh));
 			JBUFFER_TRACE(jh, "journal is aborting: refile");
@@ -638,6 +647,8 @@ void jbd2_journal_commit_transaction(journal_t *journal)
 						  jh->b_frozen_triggers :
 						  jh->b_triggers);
 			jbd2_journal_refile_buffer(journal, jh);
+			g_wait = 0;
+			smp_wmb();
 			/* If that was the last one, we need to clean up
 			 * any descriptor buffers which may have been
 			 * already allocated, even if we are now
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8804e126805f..cf56dd65d2ce 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1104,6 +1104,8 @@ do_get_write_access(handle_t *handle, struct journal_head *jh,
 			goto repeat;
 		}
 		jh->b_frozen_data = frozen_buffer;
+		if (!strncmp(current->comm, "unlink", 6))
+			pr_err("%s: set jh %px frozen data, trans %px\n", __func__, jh, jh->b_transaction);
 		frozen_buffer = NULL;
 		jbd2_freeze_jh_data(jh);
 	}
@@ -1453,6 +1455,9 @@ void jbd2_buffer_abort_trigger(struct journal_head *jh,
  * buffer: that only gets done when the old transaction finally
  * completes its commit.
  */
+#include <linux/delay.h>
+struct journal_head *g_jh;
+int g_wait = 1;
 int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
 {
 	transaction_t *transaction = handle->h_transaction;
@@ -1473,6 +1478,15 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
 	jbd_debug(5, "journal_head %p\n", jh);
 	JBUFFER_TRACE(jh, "entry");
 
+	if (!strncmp(current->comm, "unlink", 6)) {
+		pr_err("%s: jh %px trans %px wait trans changed\n", __func__, jh, jh->b_transaction);
+		while (g_wait) {
+			msleep(10);
+			smp_rmb();
+		}
+		pr_err("%s: jh %px trans %px wait done trans changed\n", __func__, jh, jh->b_transaction);
+	}
+
 	/*
 	 * This and the following assertions are unreliable since we may see jh
 	 * in inconsistent state unless we grab bh_state lock. But this is
@@ -1581,6 +1595,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
 		}
 		/* And this case is illegal: we can't reuse another
 		 * transaction's data buffer, ever. */
+		pr_err("%s: jh %px already on trans %px\n", __func__, jh, jh->b_transaction);
 		goto out_unlock_bh;
 	}
 
@@ -1591,6 +1606,10 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
 	spin_lock(&journal->j_list_lock);
 	__jbd2_journal_file_buffer(jh, transaction, BJ_Metadata);
 	spin_unlock(&journal->j_list_lock);
+	if (!strncmp(current->comm, "rm", 2)) {
+		pr_err("%s: set jh %px BJ_Metadata, trans %px\n", __func__, jh, jh->b_transaction);
+		g_jh = g_jh ? : jh;
+	}
 out_unlock_bh:
 	jbd_unlock_bh_state(bh);
 out:
```
a.c
```
#define _GNU_SOURCE             /* See feature_test_macros(7) */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/xattr.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <errno.h>
#include <string.h>
#include <linux/reboot.h>
#include <arpa/inet.h>
#include <pthread.h>
#include <grp.h>
#include <sys/prctl.h>
#include <linux/fs.h>
#include <signal.h>
#include <sched.h>
#include <sys/wait.h>
#include <sys/mman.h>
#include <linux/perf_event.h>
#include <linux/bpf.h>
#include <sys/sysinfo.h>
#include <sys/epoll.h>
#include <asm/unistd.h>
#include <sys/time.h>
#include <sys/sendfile.h>

#define EXT4_IOC_SHUTDOWN _IOR ('X', 125, __u32)
#define EXT4_GOING_FLAGS_NOLOGFLUSH             0x2

#define dev "/dev/sda"
#define mp "/root/temp"

int main(void)
{
	int i, fd;
	unsigned int arg = EXT4_GOING_FLAGS_NOLOGFLUSH;
	char buf[1024];
	system("mkfs.ext4 -F -b 4K -E lazy_itable_init=0,lazy_journal_init=0 " dev " 100M");
	system("mount -o errors=remount-ro " dev " " mp);
	system("mkdir " mp "/dir");
	system("touch " mp "/dir/f_0");
	for (i = 0; i < 10; ++i) {
		sprintf(buf, mp "/dir/f_%d", i);
		link(mp "/dir/f_0", buf);
	}
	fd = open(mp "/file", O_CREAT | O_RDWR);
	sync();
	system("rm " mp "/dir/f_1");
	system("sync &");
	sleep(1);
	system("unlink " mp "/dir/f_2 &");
	sleep(1);
	ioctl(fd, EXT4_IOC_SHUTDOWN, &arg);
	return 0;
}
```

GVP openEuler/kernel

Content Risk Flag

Comments (1)

GVPopenEuler/kernel

Content Risk Flag