【OLK-6.6】jffs文件系统压力测试过程中出现iget_locked hungtask的问题

**【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）**

**一、缺陷信息**

**内核信息：**
OLK-6.6
**缺陷归属组件：**
JFFS2
**缺陷归属的版本：**

**缺陷简述：**
JFFS2执行压力测试时触发hungtask
**【环境信息】**
硬件信息
- 裸机场景请提供问题的硬件信息
- 虚拟机场景请提供虚拟机的XML文件或配置信息
软件信息
- OS版本及分支信息
- 内核信息
- 发现问题的组件版本信息
网络信息
- 如果有特殊组网，请提供网络拓扑信息

**【问题复现步骤】**，请描述具体的操作步骤

内核config

~~~
CONFIG_MTD=y
CONFIG_JFFS2_FS=m
CONFIG_MTD_NAND_NANDSIM=m
~~~

mkdir -p /mnt/jffs
flash_erase -j /dev/mtd1
mount -t jffs2 mtd1 /mnt
编译fsstress
fsstress -d /mnt -l 0 -n 10000 -p 16

**【实际结果】**，请描述出问题的结果和影响

panic分区信息出现hungtask栈信息如下

~~~
[43133.376469][  T637] Out of memory: Killed process 639 (fsstress) total-vm:1789460kB, anon-rss:1784876kB, file-rss:640kB, shmem-rss:0kB, UID:0 pgtables:3544kB oom_score_adj:0
[48225.464141][  T637] fsstress invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
[48225.465236][  T637] CPU: 14 PID: 637 Comm: fsstress Not tainted 6.6.0+ #50
[48225.465829][  T637] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
[48225.466642][  T637] Call Trace:
[48225.466945][  T637]  <TASK>
[48225.467223][  T637]  dump_stack_lvl+0x37/0x50
[48225.467621][  T637]  dump_header+0x4a/0x240
[48225.467992][  T637]  oom_kill_process+0x11d/0x1e0
[48225.468407][  T637]  out_of_memory+0x123/0x570
[48225.468795][  T637]  __alloc_pages_slowpath.constprop.0+0xbc5/0xd80
[48225.469337][  T637]  __alloc_pages+0x308/0x350
[48225.469729][  T637]  folio_alloc+0x1b/0x50
[48225.470090][  T637]  filemap_alloc_folio+0xf9/0x150
[48225.470519][  T637]  ? jffs2_flash_writev+0x32b/0x470 [jffs2]
[48225.471020][  T637]  ? __pfx___jffs2_read_folio+0x10/0x10 [jffs2]
[48225.471557][  T637]  do_read_cache_folio+0xf3/0x3b0
[48225.471983][  T637]  ? jffs2_add_frag_to_fragtree+0x249/0x390 [jffs2]
[48225.472541][  T637]  read_cache_page+0x16/0x60
[48225.472930][  T637]  jffs2_garbage_collect_dnode.isra.0+0x1e6/0x5c0 [jffs2]
[48225.473533][  T637]  ? find_inode_fast.isra.0+0x92/0xb0
[48225.473989][  T637]  jffs2_garbage_collect_live+0x199/0x5f0 [jffs2]
[48225.474535][  T637]  ? jffs2_gc_fetch_inode+0xbf/0x190 [jffs2]
[48225.475043][  T637]  ? _atomic_dec_and_lock+0x49/0x70
[48225.475494][  T637]  jffs2_garbage_collect_pass+0x449/0x8b0 [jffs2]
[48225.476054][  T637]  ? __mutex_unlock_slowpath.isra.0+0xa8/0x130
[48225.476587][  T637]  jffs2_reserve_space+0x13b/0x340 [jffs2]
[48225.477095][  T637]  ? __alloc_pages_slowpath.constprop.0+0x123/0xd80
[48225.477662][  T637]  ? selinux_inode_permission+0xfc/0x1c0
[48225.478155][  T637]  jffs2_write_begin+0x80/0x3e0 [jffs2]
[48225.478638][  T637]  ? inode_set_ctime_current+0x3e/0x70
[48225.479111][  T637]  ? inode_io_list_move_locked+0x8a/0x110
[48225.479604][  T637]  generic_perform_write+0xce/0x210
[48225.480055][  T637]  generic_file_write_iter+0x87/0xe0
[48225.480510][  T637]  do_iter_readv_writev+0xfa/0x170
[48225.480955][  T637]  do_iter_write+0xb2/0x240
[48225.481347][  T637]  vfs_writev+0x97/0x190
[48225.481711][  T637]  ? __do_sys_newfstatat+0x35/0x60
[48225.482160][  T637]  ? __fget_light+0xec/0x110
[48225.482551][  T637]  do_writev+0x80/0x150
[48225.482914][  T637]  do_syscall_64+0x3f/0x90
[48225.483299][  T637]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[48225.483860][  T637] RIP: 0033:0x7f6d1a374610
[48225.484248][  T637] Code: Unable to access opcode bytes at 0x7f6d1a3745e6.
[48225.484850][  T637] RSP: 002b:00007ffe261248f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000014
[48225.485577][  T637] RAX: ffffffffffffffda RBX: 0000000000001769 RCX: 00007f6d1a374610
[48225.486275][  T637] RDX: 0000000000000352 RSI: 0000563b157a2210 RDI: 0000000000000004
[48225.486960][  T637] RBP: 0000000000000004 R08: 0000000000003520 R09: 0000000000000000
[48225.487643][  T637] R10: 0000000000000000 R11: 0000000000000202 R12: 0000563b157a2210
[48225.488335][  T637] R13: 0000563b15791100 R14: 0000000000000352 R15: 0000000000000052
[48225.489019][  T637]  </TASK>
[48225.489296][  T637] Mem-Info:
[48225.489574][  T637] active_anon:136 inactive_anon:3934267 isolated_anon:0
[48225.489574][  T637]  active_file:57 inactive_file:0 isolated_file:0
[48225.489574][  T637]  unevictable:0 dirty:0 writeback:0
[48225.489574][  T637]  slab_reclaimable:3203 slab_unreclaimable:61272
[48225.489574][  T637]  mapped:723 shmem:951 pagetables:8217
[48225.489574][  T637]  sec_pagetables:0 bounce:0
[48225.489574][  T637]  kernel_misc_reclaimable:0
[48225.489574][  T637]  free:66230 free_pcp:11804 free_cma:0
~~~

~~~
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
  RIP: [<ffffffff816f1256>] jffs2_garbage_collect_live+0x1578/0x1593
  Call Trace:
   [<ffffffff8154b8aa>] jffs2_garbage_collect_pass+0xf6a/0x15d0
   [<ffffffff81541bbd>] jffs2_reserve_space+0x2bd/0x8a0
   [<ffffffff81546a62>] jffs2_do_create+0x52/0x480
   [<ffffffff8153c9f2>] jffs2_create+0xe2/0x2a0
   [<ffffffff8133bed7>] vfs_create+0xe7/0x220
   [<ffffffff81340ab4>] path_openat+0x11f4/0x1c00
   [<ffffffff81343635>] do_filp_open+0xa5/0x140
   [<ffffffff813288ed>] do_sys_open+0x19d/0x320
   [<ffffffff81328a96>] SyS_open+0x26/0x30
   [<ffffffff81c3f8f8>] entry_SYSCALL_64_fastpath+0x18/0x73
~~~

**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等

流程分析：

在jffs2_do_clear_inode()中，将检查是否有任何jffs2_raw_node_ref与当前inocache相关联。如果没有raw-node-ref，则可以释放inocache。如果inocache->节点中还有一些jffs2_raw_node_ref链接，则inocache无法释放，其释放将由GC流程jffs2_move_node_refs_from_ino_list()决定。

一下流程会导致二次释放，导致可能出现各种各样的问题。

~~~
    CPU 0                   CPU 1
    in sys_unlink()         in jffs2_garbage_collect_pass()
    
    jffs2_do_unlink
      f->inocache->pino_nlink = 0
      set_nlink(inode, 0)
    
                            // contains all raw-node-refs of the unlinked inode
                            start GC a jeb
    
    iput_final
    jffs2_evict_inode
    jffs2_do_clear_inode
      acquire f->sem
        mark all refs as obsolete
    
                            GC complete
                            jeb is moved to erase_pending_list
                            jffs2_erase_pending_blocks
                              jffs2_free_jeb_node_refs
                                jffs2_remove_node_refs_from_ino_list
    
        f->inocache = INO_STATE_CHECKEDABSENT
    
                                  // no raw-node-ref is associated with the
                                  // inocache of the unlinked inode
                                  ic->nodes == (void *)ic && ic->pino_nlink == 0
                                    jffs2_del_ino_cache
    
        f->inodecache->nodes == f->nodes
          // double-free occurs
          jffs2_del_ino_cache
~~~

修复补丁修复了可能存在的GC流程中导致的竞争问题

**缺陷详情参考链接：**

**缺陷分析指导链接：**
https：xxx

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识