ext4:iomap:回写异常路径和回写流程竞争es tree导致da reservation计数错误

问题根因：
ext4 切换iomap后，后台回写线程和前台sync任务并发做writepages，异常路径+特定并发时序触发了es释放消减da reservation计数，导致da reservation计数被多减。具体时序如下：

```
write(4M) // folio 0, 1 are dirty

wb_workfn              fsync
ext4_iomap_writepages
 iomap_do_writepage // writeback folio 0
  iomap_writepage_map_blocks
   ext4_iomap_map_blocks
    ext4_iomap_map_one_extent
     ext4_map_create_blocks  // 持有EXT4_I(inode)->i_data_sem写锁
      ext4_ext_map_blocks
       ext4_da_update_reserve_space // 消减da reservation计数为0
      .
      .  >> 中间发生IO错误，日志被abort <<
      .              ext4_sync_file
      .               file_write_and_wait_range
      .                do_writepages // writeback folio 1
      .                 ext4_iomap_writepages
      .                  iomap_writepage_map_blocks
      .                   map_blocks // 失败，由于aborted journal
      .                   discard_folio
      .                    ext4_es_remove_extent  // 扫描es tree发现有512长度的delayed es
      .                     ext4_da_release_space  // da reservation计数 0 < 512
      .                      WARN_ON(1)
      ext4_es_insert_extent  // delayed es转换为unwritten es，未来得及执行
```

必现用例：
1. 打入diff编译内核
```
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 76ede16f79d9..a597ef74fb67 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -483,12 +483,14 @@ static int ext4_map_query_blocks(handle_t *handle, struct inode *inode,
 	return retval;
 }
 
+#include <linux/delay.h>
 static int ext4_map_create_blocks(handle_t *handle, struct inode *inode,
 				  struct ext4_map_blocks *map, int flags)
 {
 	struct extent_status es;
 	unsigned int status;
 	int err, retval = 0;
+	static int injected = 0;
 
 	/*
 	 * Here we clear m_flags because after allocating an new extent,
@@ -557,6 +559,13 @@ static int ext4_map_create_blocks(handle_t *handle, struct inode *inode,
 			       map->m_lblk + map->m_len - 1))
 		status |= EXTENT_STATUS_DELAYED;
 
+	if (!injected && !strcmp(inode->i_sb->s_bdev->bd_disk->disk_name, "sda")) {
+		injected = 1;
+		pr_err("wait 5s before convert delayed extents(%d:%d)\n", map->m_lblk, map->m_len);
+		msleep(5000);
+		pr_err("wait done\n");
+	}
+
 	ext4_es_insert_extent(inode, map->m_lblk, map->m_len,
 			      map->m_pblk, status);
 
@@ -3839,6 +3848,13 @@ static int ext4_iomap_map_blocks(struct iomap_writepage_ctx *wpc,
 	unsigned int index = offset >> blkbits;
 	unsigned int end, len;
 	int ret;
+	static int inject = 0;
+
+	if (!strcmp(current->comm, "sync") && !inject) {
+		inject = 1;
+		pr_err("err inject in offset %lld\n", offset);
+		return -EROFS;
+	}
 
 	if (unlikely(ext4_forced_shutdown(inode->i_sb)))
 		return -EIO;
```
2. ./test.sh
```
#!/bin/sh

DEV=/dev/sda
MNT=/root/temp
sysctl -w vm.dirty_background_bytes=10
mkfs.ext4 -b4096 -F $DEV
mount -obuffered_iomap $DEV $MNT
dd if=/dev/zero of=$MNT/file bs=8M count=1
sysctl -w vm.dirty_background_bytes=0 # wake up writeback worker
sleep 3
sync $MNT/file # concurrent writepages
umount $MNT
```
复现：
```
[    8.656086] wait 5s before convert delayed extents(0:1024)
[   11.668346] err inject in offset 2097152
[   14.148508] wait done
[   14.149793] EXT4-fs warning (device sda): ext4_da_update_reserve_space:342: ext4_da_update_reserve_space: ino 12, used 1024 with only 512 reserved data blocks
[   14.153593] ------------[ cut here ]------------
[   14.154815] WARNING: CPU: 0 PID: 2577 at fs/ext4/inode.c:346 ext4_da_update_reserve_space+0x234/0x270
[   14.157178] Modules linked in:
[   14.158024] CPU: 0 PID: 2577 Comm: sync Not tainted 6.6.0-g35359b25d137-dirty #97
[   14.159978] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
[   14.162213] RIP: 0010:ext4_da_update_reserve_space+0x234/0x270
[   14.163730] Code: c0 77 85 82 48 c7 c1 e0 59 02 83 48 83 05 53 85 11 0c 01 ba 56 01 00 00 4c 89 c6 50 53 e8 04 c7 05 00 48 83 05 44 85 11 0c 01 <0f> 0b 48 83 05 42 85 11 0c 01 8b 9d 3c 03 00 00 31 c0 5a 59 e9 14
[   14.168196] RSP: 0018:ffffc900014cf850 EFLAGS: 00010202
[   14.169143] RAX: 0000000000000092 RBX: 0000000000000400 RCX: 0000000000000000
[   14.170409] RDX: ffff88882fc29780 RSI: ffff88882fc1ce00 RDI: ffff88882fc1ce00
[   14.171680] RBP: ffff888179f3f4a8 R08: 0000000000000000 R09: ffffc900014cf680
[   14.172960] R10: ffffffff8330f180 R11: ffffffff8a30f168 R12: 0000000000000001
[   14.174228] R13: ffff8881025fb000 R14: ffff888179f3f88c R15: ffff8881025fb000
[   14.175503] FS:  00007f0b277d54c0(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000
[   14.176948] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   14.177994] CR2: 0000555747ed8008 CR3: 000000017a70f000 CR4: 00000000000006f0
[   14.179092] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   14.179999] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   14.180904] Call Trace:
[   14.181240]  <TASK>
[   14.181537]  ? show_regs+0x88/0xa0
[   14.181989]  ? __warn+0xb5/0x260
[   14.182426]  ? ext4_da_update_reserve_space+0x234/0x270
[   14.183094]  ? report_bug+0x1ea/0x260
[   14.183588]  ? handle_bug+0xa5/0xc0
[   14.184045]  ? exc_invalid_op+0x1f/0x80
[   14.184555]  ? asm_exc_invalid_op+0x1a/0x20
[   14.185091]  ? ext4_da_update_reserve_space+0x234/0x270
[   14.185765]  ext4_ext_map_blocks+0x5fa/0x2870
[   14.186326]  ext4_map_create_blocks+0x3d/0x330
[   14.186916]  ? ext4_es_lookup_extent+0x1c4/0x3a0
[   14.187519]  ext4_iomap_map_blocks+0x379/0x640
[   14.188095]  iomap_do_writepage+0x1cf/0xee0
[   14.188650]  write_cache_pages+0x106/0x580
[   14.189123]  ? iomap_write_begin+0x410/0x410
[   14.189587]  ? dput+0x1ca/0x840
[   14.189926]  ? fscrypt_file_open+0x59/0x140
[   14.190380]  ? dquot_file_open+0x1e/0x60
[   14.190796]  ? ext4_file_open+0xd1/0x470
[   14.191211]  ? generic_permission+0x49/0x460
[   14.191678]  iomap_writepages+0x40/0x80
[   14.192090]  ext4_iomap_writepages+0x100/0x3c0
[   14.192577]  do_writepages+0x7c/0x250
[   14.192970]  filemap_fdatawrite_wbc+0x8d/0xe0
[   14.193444]  __filemap_fdatawrite_range+0x56/0x70
[   14.193945]  file_write_and_wait_range+0x6e/0xf0
[   14.194447]  ext4_sync_file+0x9e/0x610
[   14.194842]  vfs_fsync_range+0x46/0xb0
[   14.195244]  do_fsync+0x4a/0xa0
[   14.195595]  __x64_sys_fsync+0x1b/0x30
[   14.195996]  x64_sys_call+0x204c/0x3e80
[   14.196413]  do_syscall_64+0xa2/0x1b0
[   14.196804]  ? clear_bhb_loop+0x25/0x80
[   14.197216]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[   14.197755] RIP: 0033:0x7f0b27106e40
[   14.198138] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 83 3d a9 d8 2c 00 00 75 10 b8 4a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 2e 86 01 00 48 89 04 24
[   14.200061] RSP: 002b:00007fff48c48b68 EFLAGS: 00000246 ORIG_RAX: 000000000000004a
[   14.200858] RAX: ffffffffffffffda RBX: 00007fff48c48ca8 RCX: 00007f0b27106e40
[   14.201615] RDX: 0000000000008000 RSI: 0000000000000004 RDI: 0000000000000003
[   14.202360] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[   14.203114] R10: fffffffffffff411 R11: 0000000000000246 R12: 0000000000000003
[   14.203860] R13: 00007f0b273cf1e4 R14: 0000000000000001 R15: 00007fff48c4a4d7
[   14.204853]  </TASK>
[   14.205126] ---[ end trace 0000000000000000 ]---
```

GVP openEuler/kernel

Content Risk Flag

Comments (1)

GVPopenEuler/kernel

Content Risk Flag