[v2] f2fs: fix inconsistent dirty state of atomic file

[PATCH v2] f2fs: fix inconsistent dirty state of atomic file

Posted by Jianan Huang 6 days, 3 hours ago

When testing the atomic write fix patches, the f2fs_bug_on was
triggered as below:

------------[ cut here ]------------
kernel BUG at fs/f2fs/inode.c:935!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 3 UID: 0 PID: 257 Comm: bash Not tainted 6.13.0-rc1-00033-gc283a70d3497 #5
RIP: 0010:f2fs_evict_inode+0x50f/0x520
Call Trace:
 <TASK>
 ? __die_body+0x65/0xb0
 ? die+0x9f/0xc0
 ? do_trap+0xa1/0x170
 ? f2fs_evict_inode+0x50f/0x520
 ? f2fs_evict_inode+0x50f/0x520
 ? handle_invalid_op+0x65/0x80
 ? f2fs_evict_inode+0x50f/0x520
 ? exc_invalid_op+0x39/0x50
 ? asm_exc_invalid_op+0x1a/0x20
 ? __pfx_f2fs_get_dquots+0x10/0x10
 ? f2fs_evict_inode+0x50f/0x520
 ? f2fs_evict_inode+0x2e5/0x520
 evict+0x186/0x2f0
 prune_icache_sb+0x75/0xb0
 super_cache_scan+0x1a8/0x200
 do_shrink_slab+0x163/0x320
 shrink_slab+0x2fc/0x470
 drop_slab+0x82/0xf0
 drop_caches_sysctl_handler+0x4e/0xb0
 proc_sys_call_handler+0x183/0x280
 vfs_write+0x36d/0x450
 ksys_write+0x68/0xd0
 do_syscall_64+0xc8/0x1a0
 ? arch_exit_to_user_mode_prepare+0x11/0x60
 ? irqentry_exit_to_user_mode+0x7e/0xa0

The root cause is: f2fs uses FI_ATOMIC_DIRTIED to indicate dirty
atomic files during commit. If the inode is dirtied during commit,
such as by f2fs_i_pino_write, the vfs inode keeps clean and the
f2fs inode is set to FI_DIRTY_INODE. The FI_DIRTY_INODE flag cann't
be cleared by write_inode later due to the clean vfs inode. Finally,
f2fs_bug_on is triggered due to this inconsistent state when evict.

To reproduce this situation:
- fd = open("/mnt/test.db", O_WRONLY)
- ioctl(fd, F2FS_IOC_START_ATOMIC_WRITE)
- mv /mnt/test.db /mnt/test1.db
- ioctl(fd, F2FS_IOC_COMMIT_ATOMIC_WRITE)
- echo 3 > /proc/sys/vm/drop_caches

To fix this problem, clear FI_DIRTY_INODE after commit, then
f2fs_mark_inode_dirty_sync will ensure a consistent dirty state.

Fixes: fccaa81de87e ("f2fs: prevent atomic file from being dirtied before commit")
Signed-off-by: Yunlei He <heyunlei@xiaomi.com>
Signed-off-by: Jianan Huang <huangjianan@xiaomi.com>
---
Changes since v1:
- Add comments suggested by Chao.
- Add missing stat reduction.

 fs/f2fs/segment.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index dc1b47f9269a..de1597110f76 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -201,6 +201,15 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)
 	clear_inode_flag(inode, FI_ATOMIC_FILE);
 	if (is_inode_flag_set(inode, FI_ATOMIC_DIRTIED)) {
 		clear_inode_flag(inode, FI_ATOMIC_DIRTIED);
+		/*
+		 * The vfs inode keeps clean during commit, but the f2fs inode
+		 * doesn't. So clear the dirty state after commit and let
+		 * f2fs_mark_inode_dirty_sync ensure a consistent dirty state.
+		 */
+		if (is_inode_flag_set(inode, FI_DIRTY_INODE)) {
+			clear_inode_flag(inode, FI_DIRTY_INODE);
+			stat_dec_dirty_inode(F2FS_I_SB(inode), DIRTY_META);
+		}
 		f2fs_mark_inode_dirty_sync(inode, true);
 	}
 	stat_dec_atomic_inode(inode);
-- 
2.43.0

Re: [PATCH v2] f2fs: fix inconsistent dirty state of atomic file

Posted by Chao Yu 5 days, 23 hours ago


On 1/24/25 09:50, Jianan Huang wrote:
> When testing the atomic write fix patches, the f2fs_bug_on was
> triggered as below:
> 
> ------------[ cut here ]------------
> kernel BUG at fs/f2fs/inode.c:935!
> Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
> CPU: 3 UID: 0 PID: 257 Comm: bash Not tainted 6.13.0-rc1-00033-gc283a70d3497 #5
> RIP: 0010:f2fs_evict_inode+0x50f/0x520
> Call Trace:
>  <TASK>
>  ? __die_body+0x65/0xb0
>  ? die+0x9f/0xc0
>  ? do_trap+0xa1/0x170
>  ? f2fs_evict_inode+0x50f/0x520
>  ? f2fs_evict_inode+0x50f/0x520
>  ? handle_invalid_op+0x65/0x80
>  ? f2fs_evict_inode+0x50f/0x520
>  ? exc_invalid_op+0x39/0x50
>  ? asm_exc_invalid_op+0x1a/0x20
>  ? __pfx_f2fs_get_dquots+0x10/0x10
>  ? f2fs_evict_inode+0x50f/0x520
>  ? f2fs_evict_inode+0x2e5/0x520
>  evict+0x186/0x2f0
>  prune_icache_sb+0x75/0xb0
>  super_cache_scan+0x1a8/0x200
>  do_shrink_slab+0x163/0x320
>  shrink_slab+0x2fc/0x470
>  drop_slab+0x82/0xf0
>  drop_caches_sysctl_handler+0x4e/0xb0
>  proc_sys_call_handler+0x183/0x280
>  vfs_write+0x36d/0x450
>  ksys_write+0x68/0xd0
>  do_syscall_64+0xc8/0x1a0
>  ? arch_exit_to_user_mode_prepare+0x11/0x60
>  ? irqentry_exit_to_user_mode+0x7e/0xa0
> 
> The root cause is: f2fs uses FI_ATOMIC_DIRTIED to indicate dirty
> atomic files during commit. If the inode is dirtied during commit,
> such as by f2fs_i_pino_write, the vfs inode keeps clean and the
> f2fs inode is set to FI_DIRTY_INODE. The FI_DIRTY_INODE flag cann't
> be cleared by write_inode later due to the clean vfs inode. Finally,
> f2fs_bug_on is triggered due to this inconsistent state when evict.
> 
> To reproduce this situation:
> - fd = open("/mnt/test.db", O_WRONLY)
> - ioctl(fd, F2FS_IOC_START_ATOMIC_WRITE)
> - mv /mnt/test.db /mnt/test1.db
> - ioctl(fd, F2FS_IOC_COMMIT_ATOMIC_WRITE)
> - echo 3 > /proc/sys/vm/drop_caches
> 
> To fix this problem, clear FI_DIRTY_INODE after commit, then
> f2fs_mark_inode_dirty_sync will ensure a consistent dirty state.
> 
> Fixes: fccaa81de87e ("f2fs: prevent atomic file from being dirtied before commit")
> Signed-off-by: Yunlei He <heyunlei@xiaomi.com>
> Signed-off-by: Jianan Huang <huangjianan@xiaomi.com>
> ---
> Changes since v1:
> - Add comments suggested by Chao.
> - Add missing stat reduction.
> 
>  fs/f2fs/segment.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
> index dc1b47f9269a..de1597110f76 100644
> --- a/fs/f2fs/segment.c
> +++ b/fs/f2fs/segment.c
> @@ -201,6 +201,15 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)
>  	clear_inode_flag(inode, FI_ATOMIC_FILE);
>  	if (is_inode_flag_set(inode, FI_ATOMIC_DIRTIED)) {
>  		clear_inode_flag(inode, FI_ATOMIC_DIRTIED);
> +		/*
> +		 * The vfs inode keeps clean during commit, but the f2fs inode
> +		 * doesn't. So clear the dirty state after commit and let
> +		 * f2fs_mark_inode_dirty_sync ensure a consistent dirty state.
> +		 */
> +		if (is_inode_flag_set(inode, FI_DIRTY_INODE)) {
> +			clear_inode_flag(inode, FI_DIRTY_INODE);
> +			stat_dec_dirty_inode(F2FS_I_SB(inode), DIRTY_META);
> +		}

How about calling f2fs_inode_synced() directly?

>  		f2fs_mark_inode_dirty_sync(inode, true);
>  	}
>  	stat_dec_atomic_inode(inode);

Re: [External Mail]Re: [PATCH v2] f2fs: fix inconsistent dirty state of atomic file

Posted by Huang Jianan 5 days, 23 hours ago

On 2025/1/24 13:14, Chao Yu wrote:
> 
> On 1/24/25 09:50, Jianan Huang wrote:
>> When testing the atomic write fix patches, the f2fs_bug_on was
>> triggered as below:
>>
>> ------------[ cut here ]------------
>> kernel BUG at fs/f2fs/inode.c:935!
>> Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
>> CPU: 3 UID: 0 PID: 257 Comm: bash Not tainted 6.13.0-rc1-00033-gc283a70d3497 #5
>> RIP: 0010:f2fs_evict_inode+0x50f/0x520
>> Call Trace:
>>   <TASK>
>>   ? __die_body+0x65/0xb0
>>   ? die+0x9f/0xc0
>>   ? do_trap+0xa1/0x170
>>   ? f2fs_evict_inode+0x50f/0x520
>>   ? f2fs_evict_inode+0x50f/0x520
>>   ? handle_invalid_op+0x65/0x80
>>   ? f2fs_evict_inode+0x50f/0x520
>>   ? exc_invalid_op+0x39/0x50
>>   ? asm_exc_invalid_op+0x1a/0x20
>>   ? __pfx_f2fs_get_dquots+0x10/0x10
>>   ? f2fs_evict_inode+0x50f/0x520
>>   ? f2fs_evict_inode+0x2e5/0x520
>>   evict+0x186/0x2f0
>>   prune_icache_sb+0x75/0xb0
>>   super_cache_scan+0x1a8/0x200
>>   do_shrink_slab+0x163/0x320
>>   shrink_slab+0x2fc/0x470
>>   drop_slab+0x82/0xf0
>>   drop_caches_sysctl_handler+0x4e/0xb0
>>   proc_sys_call_handler+0x183/0x280
>>   vfs_write+0x36d/0x450
>>   ksys_write+0x68/0xd0
>>   do_syscall_64+0xc8/0x1a0
>>   ? arch_exit_to_user_mode_prepare+0x11/0x60
>>   ? irqentry_exit_to_user_mode+0x7e/0xa0
>>
>> The root cause is: f2fs uses FI_ATOMIC_DIRTIED to indicate dirty
>> atomic files during commit. If the inode is dirtied during commit,
>> such as by f2fs_i_pino_write, the vfs inode keeps clean and the
>> f2fs inode is set to FI_DIRTY_INODE. The FI_DIRTY_INODE flag cann't
>> be cleared by write_inode later due to the clean vfs inode. Finally,
>> f2fs_bug_on is triggered due to this inconsistent state when evict.
>>
>> To reproduce this situation:
>> - fd = open("/mnt/test.db", O_WRONLY)
>> - ioctl(fd, F2FS_IOC_START_ATOMIC_WRITE)
>> - mv /mnt/test.db /mnt/test1.db
>> - ioctl(fd, F2FS_IOC_COMMIT_ATOMIC_WRITE)
>> - echo 3 > /proc/sys/vm/drop_caches
>>
>> To fix this problem, clear FI_DIRTY_INODE after commit, then
>> f2fs_mark_inode_dirty_sync will ensure a consistent dirty state.
>>
>> Fixes: fccaa81de87e ("f2fs: prevent atomic file from being dirtied before commit")
>> Signed-off-by: Yunlei He <heyunlei@xiaomi.com>
>> Signed-off-by: Jianan Huang <huangjianan@xiaomi.com>
>> ---
>> Changes since v1:
>> - Add comments suggested by Chao.
>> - Add missing stat reduction.
>>
>>   fs/f2fs/segment.c | 9 +++++++++
>>   1 file changed, 9 insertions(+)
>>
>> diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
>> index dc1b47f9269a..de1597110f76 100644
>> --- a/fs/f2fs/segment.c
>> +++ b/fs/f2fs/segment.c
>> @@ -201,6 +201,15 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)
>>        clear_inode_flag(inode, FI_ATOMIC_FILE);
>>        if (is_inode_flag_set(inode, FI_ATOMIC_DIRTIED)) {
>>                clear_inode_flag(inode, FI_ATOMIC_DIRTIED);
>> +             /*
>> +              * The vfs inode keeps clean during commit, but the f2fs inode
>> +              * doesn't. So clear the dirty state after commit and let
>> +              * f2fs_mark_inode_dirty_sync ensure a consistent dirty state.
>> +              */
>> +             if (is_inode_flag_set(inode, FI_DIRTY_INODE)) {
>> +                     clear_inode_flag(inode, FI_DIRTY_INODE);
>> +                     stat_dec_dirty_inode(F2FS_I_SB(inode), DIRTY_META);
>> +             }
> 
> How about calling f2fs_inode_synced() directly?

It looks more clear, I will update it in v3.

Thanks,

> 
>>                f2fs_mark_inode_dirty_sync(inode, true);
>>        }
>>        stat_dec_atomic_inode(inode);
>

[PATCH v3] f2fs: fix inconsistent dirty state of atomic file

Posted by Jianan Huang 5 days, 22 hours ago

When testing the atomic write fix patches, the f2fs_bug_on was
triggered as below:

------------[ cut here ]------------
kernel BUG at fs/f2fs/inode.c:935!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 3 UID: 0 PID: 257 Comm: bash Not tainted 6.13.0-rc1-00033-gc283a70d3497 #5
RIP: 0010:f2fs_evict_inode+0x50f/0x520
Call Trace:
 <TASK>
 ? __die_body+0x65/0xb0
 ? die+0x9f/0xc0
 ? do_trap+0xa1/0x170
 ? f2fs_evict_inode+0x50f/0x520
 ? f2fs_evict_inode+0x50f/0x520
 ? handle_invalid_op+0x65/0x80
 ? f2fs_evict_inode+0x50f/0x520
 ? exc_invalid_op+0x39/0x50
 ? asm_exc_invalid_op+0x1a/0x20
 ? __pfx_f2fs_get_dquots+0x10/0x10
 ? f2fs_evict_inode+0x50f/0x520
 ? f2fs_evict_inode+0x2e5/0x520
 evict+0x186/0x2f0
 prune_icache_sb+0x75/0xb0
 super_cache_scan+0x1a8/0x200
 do_shrink_slab+0x163/0x320
 shrink_slab+0x2fc/0x470
 drop_slab+0x82/0xf0
 drop_caches_sysctl_handler+0x4e/0xb0
 proc_sys_call_handler+0x183/0x280
 vfs_write+0x36d/0x450
 ksys_write+0x68/0xd0
 do_syscall_64+0xc8/0x1a0
 ? arch_exit_to_user_mode_prepare+0x11/0x60
 ? irqentry_exit_to_user_mode+0x7e/0xa0

The root cause is: f2fs uses FI_ATOMIC_DIRTIED to indicate dirty
atomic files during commit. If the inode is dirtied during commit,
such as by f2fs_i_pino_write, the vfs inode keeps clean and the
f2fs inode is set to FI_DIRTY_INODE. The FI_DIRTY_INODE flag cann't
be cleared by write_inode later due to the clean vfs inode. Finally,
f2fs_bug_on is triggered due to this inconsistent state when evict.

To reproduce this situation:
- fd = open("/mnt/test.db", O_WRONLY)
- ioctl(fd, F2FS_IOC_START_ATOMIC_WRITE)
- mv /mnt/test.db /mnt/test1.db
- ioctl(fd, F2FS_IOC_COMMIT_ATOMIC_WRITE)
- echo 3 > /proc/sys/vm/drop_caches

To fix this problem, clear FI_DIRTY_INODE after commit, then
f2fs_mark_inode_dirty_sync will ensure a consistent dirty state.

Fixes: fccaa81de87e ("f2fs: prevent atomic file from being dirtied before commit")
Signed-off-by: Yunlei He <heyunlei@xiaomi.com>
Signed-off-by: Jianan Huang <huangjianan@xiaomi.com>
---
Changes since v2:
- Use f2fs_inode_synced instead of just clear FI_DIRTY_INODE.
Changes since v1:
- Add comments suggested by Chao.
- Add missing stat reduction.

 fs/f2fs/segment.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index dc1b47f9269a..c282e8a0a2ec 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -201,6 +201,12 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)
 	clear_inode_flag(inode, FI_ATOMIC_FILE);
 	if (is_inode_flag_set(inode, FI_ATOMIC_DIRTIED)) {
 		clear_inode_flag(inode, FI_ATOMIC_DIRTIED);
+		/*
+		 * The vfs inode keeps clean during commit, but the f2fs inode
+		 * doesn't. So clear the dirty state after commit and let
+		 * f2fs_mark_inode_dirty_sync ensure a consistent dirty state.
+		 */
+		f2fs_inode_synced(inode);
 		f2fs_mark_inode_dirty_sync(inode, true);
 	}
 	stat_dec_atomic_inode(inode);
-- 
2.43.0

Re: [PATCH v3] f2fs: fix inconsistent dirty state of atomic file

Posted by Chao Yu 5 days, 21 hours ago

On 1/24/25 13:57, Jianan Huang wrote:
> When testing the atomic write fix patches, the f2fs_bug_on was
> triggered as below:
> 
> ------------[ cut here ]------------
> kernel BUG at fs/f2fs/inode.c:935!
> Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
> CPU: 3 UID: 0 PID: 257 Comm: bash Not tainted 6.13.0-rc1-00033-gc283a70d3497 #5
> RIP: 0010:f2fs_evict_inode+0x50f/0x520
> Call Trace:
>  <TASK>
>  ? __die_body+0x65/0xb0
>  ? die+0x9f/0xc0
>  ? do_trap+0xa1/0x170
>  ? f2fs_evict_inode+0x50f/0x520
>  ? f2fs_evict_inode+0x50f/0x520
>  ? handle_invalid_op+0x65/0x80
>  ? f2fs_evict_inode+0x50f/0x520
>  ? exc_invalid_op+0x39/0x50
>  ? asm_exc_invalid_op+0x1a/0x20
>  ? __pfx_f2fs_get_dquots+0x10/0x10
>  ? f2fs_evict_inode+0x50f/0x520
>  ? f2fs_evict_inode+0x2e5/0x520
>  evict+0x186/0x2f0
>  prune_icache_sb+0x75/0xb0
>  super_cache_scan+0x1a8/0x200
>  do_shrink_slab+0x163/0x320
>  shrink_slab+0x2fc/0x470
>  drop_slab+0x82/0xf0
>  drop_caches_sysctl_handler+0x4e/0xb0
>  proc_sys_call_handler+0x183/0x280
>  vfs_write+0x36d/0x450
>  ksys_write+0x68/0xd0
>  do_syscall_64+0xc8/0x1a0
>  ? arch_exit_to_user_mode_prepare+0x11/0x60
>  ? irqentry_exit_to_user_mode+0x7e/0xa0
> 
> The root cause is: f2fs uses FI_ATOMIC_DIRTIED to indicate dirty
> atomic files during commit. If the inode is dirtied during commit,
> such as by f2fs_i_pino_write, the vfs inode keeps clean and the
> f2fs inode is set to FI_DIRTY_INODE. The FI_DIRTY_INODE flag cann't
> be cleared by write_inode later due to the clean vfs inode. Finally,
> f2fs_bug_on is triggered due to this inconsistent state when evict.
> 
> To reproduce this situation:
> - fd = open("/mnt/test.db", O_WRONLY)
> - ioctl(fd, F2FS_IOC_START_ATOMIC_WRITE)
> - mv /mnt/test.db /mnt/test1.db
> - ioctl(fd, F2FS_IOC_COMMIT_ATOMIC_WRITE)
> - echo 3 > /proc/sys/vm/drop_caches
> 
> To fix this problem, clear FI_DIRTY_INODE after commit, then
> f2fs_mark_inode_dirty_sync will ensure a consistent dirty state.
> 
> Fixes: fccaa81de87e ("f2fs: prevent atomic file from being dirtied before commit")
> Signed-off-by: Yunlei He <heyunlei@xiaomi.com>
> Signed-off-by: Jianan Huang <huangjianan@xiaomi.com>

Reviewed-by: Chao Yu <chao@kernel.org>

Thanks,