fs/netfs/objects.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
In addition to Ceph, in NFS there are also some crashes related to the
use of 0x356 as a pointer.
`netfs_is_cache_enabled()` only returns true when the fscache cookie is
fully initialized. This may happen after the request has been created,
so check for the cookie's existence instead.
Link: https://lore.kernel.org/linux-nfs/b78c88db-8b3a-4008-94cb-82ae08f0e37b@free.fr/T/
Fixes: 2ff1e97587f4 ("netfs: Replace PG_fscache by setting folio->private and marking dirty")
Cc: linux-nfs@vger.kernel.org <linux-nfs@vger.kernel.org>
Cc: blokos <blokos@free.fr>
Cc: Trond Myklebust <trondmy@hammerspace.com>
Cc: dan.aloni@vastdata.com <dan.aloni@vastdata.com>
Signed-off-by: Hristo Venev <hristo@venev.name>
---
fs/netfs/objects.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/netfs/objects.c b/fs/netfs/objects.c
index f4a6427274792..a74ca90c86c9b 100644
--- a/fs/netfs/objects.c
+++ b/fs/netfs/objects.c
@@ -27,7 +27,6 @@ struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,
bool is_unbuffered = (origin == NETFS_UNBUFFERED_WRITE ||
origin == NETFS_DIO_READ ||
origin == NETFS_DIO_WRITE);
- bool cached = !is_unbuffered && netfs_is_cache_enabled(ctx);
int ret;
for (;;) {
@@ -56,8 +55,9 @@ struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,
refcount_set(&rreq->ref, 1);
__set_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags);
- if (cached) {
- __set_bit(NETFS_RREQ_WRITE_TO_CACHE, &rreq->flags);
+ if (!is_unbuffered && fscache_cookie_valid(netfs_i_cookie(ctx))) {
+ if(netfs_is_cache_enabled(ctx))
+ __set_bit(NETFS_RREQ_WRITE_TO_CACHE, &rreq->flags);
if (test_bit(NETFS_ICTX_USE_PGPRIV2, &ctx->flags))
/* Filesystem uses deprecated PG_private_2 marking. */
__set_bit(NETFS_RREQ_USE_PGPRIV2, &rreq->flags);
On Sun, 2024-08-04 at 16:57 +0300, Hristo Venev wrote:
> In addition to Ceph, in NFS there are also some crashes related to
> the
> use of 0x356 as a pointer.
>
> `netfs_is_cache_enabled()` only returns true when the fscache cookie
> is
> fully initialized. This may happen after the request has been
> created,
> so check for the cookie's existence instead.
>
> Link:
> https://lore.kernel.org/linux-nfs/b78c88db-8b3a-4008-94cb-82ae08f0e37b@free.fr/T/
> Fixes: 2ff1e97587f4 ("netfs: Replace PG_fscache by setting folio-
> >private and marking dirty")
> Cc: linux-nfs@vger.kernel.org <linux-nfs@vger.kernel.org>
> Cc: blokos <blokos@free.fr>
> Cc: Trond Myklebust <trondmy@hammerspace.com>
> Cc: dan.aloni@vastdata.com <dan.aloni@vastdata.com>
> Signed-off-by: Hristo Venev <hristo@venev.name>
> ---
> fs/netfs/objects.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/fs/netfs/objects.c b/fs/netfs/objects.c
> index f4a6427274792..a74ca90c86c9b 100644
> --- a/fs/netfs/objects.c
> +++ b/fs/netfs/objects.c
> @@ -27,7 +27,6 @@ struct netfs_io_request *netfs_alloc_request(struct
> address_space *mapping,
> bool is_unbuffered = (origin == NETFS_UNBUFFERED_WRITE ||
> origin == NETFS_DIO_READ ||
> origin == NETFS_DIO_WRITE);
> - bool cached = !is_unbuffered && netfs_is_cache_enabled(ctx);
> int ret;
>
> for (;;) {
> @@ -56,8 +55,9 @@ struct netfs_io_request *netfs_alloc_request(struct
> address_space *mapping,
> refcount_set(&rreq->ref, 1);
>
> __set_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags);
> - if (cached) {
> - __set_bit(NETFS_RREQ_WRITE_TO_CACHE, &rreq->flags);
> + if (!is_unbuffered &&
> fscache_cookie_valid(netfs_i_cookie(ctx))) {
> + if(netfs_is_cache_enabled(ctx))
> + __set_bit(NETFS_RREQ_WRITE_TO_CACHE, &rreq-
> >flags);
> if (test_bit(NETFS_ICTX_USE_PGPRIV2, &ctx->flags))
> /* Filesystem uses deprecated PG_private_2
> marking. */
> __set_bit(NETFS_RREQ_USE_PGPRIV2, &rreq-
> >flags);
Does this mean that netfs could still end up setting a value for folio-
>private in NFS given some other set of circumstances?
--
Trond Myklebust
Linux NFS client maintainer, Hammerspace
trond.myklebust@hammerspace.com
On Sun, 2024-08-04 at 23:22 +0000, Trond Myklebust wrote:
> On Sun, 2024-08-04 at 16:57 +0300, Hristo Venev wrote:
> > In addition to Ceph, in NFS there are also some crashes related to
> > the
> > use of 0x356 as a pointer.
> >
> > `netfs_is_cache_enabled()` only returns true when the fscache
> > cookie
> > is
> > fully initialized. This may happen after the request has been
> > created,
> > so check for the cookie's existence instead.
> >
> > Link:
> > https://lore.kernel.org/linux-nfs/b78c88db-8b3a-4008-94cb-82ae08f0e37b@free.fr/T/
> > Fixes: 2ff1e97587f4 ("netfs: Replace PG_fscache by setting folio-
> > > private and marking dirty")
> > Cc: linux-nfs@vger.kernel.org <linux-nfs@vger.kernel.org>
> > Cc: blokos <blokos@free.fr>
> > Cc: Trond Myklebust <trondmy@hammerspace.com>
> > Cc: dan.aloni@vastdata.com <dan.aloni@vastdata.com>
> > Signed-off-by: Hristo Venev <hristo@venev.name>
> > ---
> > fs/netfs/objects.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/fs/netfs/objects.c b/fs/netfs/objects.c
> > index f4a6427274792..a74ca90c86c9b 100644
> > --- a/fs/netfs/objects.c
> > +++ b/fs/netfs/objects.c
> > @@ -27,7 +27,6 @@ struct netfs_io_request
> > *netfs_alloc_request(struct
> > address_space *mapping,
> > bool is_unbuffered = (origin == NETFS_UNBUFFERED_WRITE ||
> > origin == NETFS_DIO_READ ||
> > origin == NETFS_DIO_WRITE);
> > - bool cached = !is_unbuffered &&
> > netfs_is_cache_enabled(ctx);
> > int ret;
> >
> > for (;;) {
> > @@ -56,8 +55,9 @@ struct netfs_io_request
> > *netfs_alloc_request(struct
> > address_space *mapping,
> > refcount_set(&rreq->ref, 1);
> >
> > __set_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags);
> > - if (cached) {
> > - __set_bit(NETFS_RREQ_WRITE_TO_CACHE, &rreq-
> > >flags);
> > + if (!is_unbuffered &&
> > fscache_cookie_valid(netfs_i_cookie(ctx))) {
> > + if(netfs_is_cache_enabled(ctx))
> > + __set_bit(NETFS_RREQ_WRITE_TO_CACHE,
> > &rreq-
> > > flags);
> > if (test_bit(NETFS_ICTX_USE_PGPRIV2, &ctx->flags))
> > /* Filesystem uses deprecated PG_private_2
> > marking. */
> > __set_bit(NETFS_RREQ_USE_PGPRIV2, &rreq-
> > > flags);
>
> Does this mean that netfs could still end up setting a value for
> folio-
> > private in NFS given some other set of circumstances?
Hopefully not? For NFS the cookie should be allocated in
`nfs_fscache_init_inode`, and for Ceph I think `ceph_fill_inode` (which
calls `ceph_fscache_register_inode_cookie`) should also be called early
enough as well.
> --
> Trond Myklebust
> Linux NFS client maintainer, Hammerspace
> trond.myklebust@hammerspace.com
>
>
© 2016 - 2025 Red Hat, Inc.