2008-01-12 16:31:54

by Aneesh Kumar K.V

[permalink] [raw]
Subject: Re: [Fwd: [Bug 9732] New: oops in extent code via ext4_fallocate]

On Fri, Jan 11, 2008 at 02:42:00PM -0600, Eric Sandeen wrote:

>
> The BUG_ON is:
>
> BUG_ON(*logical < le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len));
>
> where these were the values:
>
> logical 8 ee_block 0 ee_len 32776
>
> Haven't looked further into it yet.
>

Not able to reproduce. Why is it calling ext4_ext_search_left for that
value of logical ? ext4_ext_get_blocks should have found that the
logical belong to an already existing extent and return from there. It
should have returned from

2365 if (create == EXT4_CREATE_UNINITIALIZED_EXT)
2366 goto out;


root@qemu-image:/ext4# /root/testfallocate -f a 0 100
# FALLOCATE TEST REPORT #
New blocks preallocated = 0.
Number of bytes preallocated = 0
Old file size = 100, New file size 100.
Old num blocks = 4, New num blocks 4.


### TESTS PASSED ###
root@qemu-image:/ext4# ls -alh a
-rw-r--r-- 1 root root 100 Jan 9 16:23 a
root@qemu-image:/ext4# /root/truncate ./a 50
root@qemu-image:/ext4# ls -alh a
-rw-r--r-- 1 root root 50 Jan 9 16:23 a
root@qemu-image:/ext4# /root/testfallocate -f a 0 100
# FALLOCATE TEST REPORT #
New blocks preallocated = 0.
Number of bytes preallocated = 0
Old file size = 50, New file size 100.
Old num blocks = 4, New num blocks 4.


### TESTS PASSED ###
root@qemu-image:/ext4# ls -alh a
-rw-r--r-- 1 root root 100 Jan 9 16:23 a
root@qemu-image:/ext4# more /proc/mounts | grep ext4dev
/dev/hdc /ext4 ext4dev rw,nodelalloc,data=writeback 0 0
root@qemu-image:/ext4#

The third fallocate should result in calling ext4_ext_get_blocks two
times. The first call with logical 0 and max 100 and it will return with
allocated 50. Then call again with logical 50 and max 50.

Something else is wrong.

-aneesh

2008-01-12 16:41:07

by Eric Sandeen

[permalink] [raw]
Subject: Re: [Fwd: [Bug 9732] New: oops in extent code via ext4_fallocate]

Aneesh Kumar K.V wrote:
> On Fri, Jan 11, 2008 at 02:42:00PM -0600, Eric Sandeen wrote:
>
>> The BUG_ON is:
>>
>> BUG_ON(*logical < le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len));
>>
>> where these were the values:
>>
>> logical 8 ee_block 0 ee_len 32776
>>
>> Haven't looked further into it yet.
>>
>
> Not able to reproduce. Why is it calling ext4_ext_search_left for that
> value of logical ? ext4_ext_get_blocks should have found that the
> logical belong to an already existing extent and return from there. It
> should have returned from
>
> 2365 if (create == EXT4_CREATE_UNINITIALIZED_EXT)
> 2366 goto out;
>
>
> root@qemu-image:/ext4# /root/testfallocate -f a 0 100

> root@qemu-image:/ext4# /root/truncate ./a 50

> root@qemu-image:/ext4# /root/testfallocate -f a 0 100

This isn't exercising extents code at all, all your sizes are all within
the first block. Try the numbers I have in the bug?

Or more simply,

[root@bear-05 sdb8]# ./testfallocate -f testfile 0 32768
[root@bear-05 sdb8]# ./testfallocate -f testfile 16384 65536

or

[root@bear-05 sdb8]# ./testfallocate -f testfile 0 16384
[root@bear-05 sdb8]# ./testfallocate -f testfile 32768 65536


-Eric

2008-01-12 16:46:02

by Eric Sandeen

[permalink] [raw]
Subject: Re: [Fwd: [Bug 9732] New: oops in extent code via ext4_fallocate]

Eric Sandeen wrote:
> [root@bear-05 sdb8]# ./testfallocate -f testfile 0 32768
> [root@bear-05 sdb8]# ./testfallocate -f testfile 16384 65536

(oh, for completeness I started with a fresh 0 length, 0 size file):

# rm -f testfile; touch testfile
<testfallocate tests>

-Eric

2008-01-12 18:14:07

by Aneesh Kumar K.V

[permalink] [raw]
Subject: [PATCH] ext4: use ext4_ext_get_actual_len instead of directly using ext4_extent.ee_len


ext4 use the extent len for encoding whether the extent is intialized or
not. The helper function ext4_ext_get_actual_len should be used to get the
actual length of the extent.

Fix the below kernel BUG
http://bugzilla.kernel.org/show_bug.cgi?id=9732

kernel BUG at fs/ext4/extents.c:1056!
....
Call Trace:
[<ffffffff88366073>] :ext4dev:ext4_ext_get_blocks+0x5ba/0x8c1
[<ffffffff81053c91>] lock_release_holdtime+0x27/0x49
[<ffffffff812748f6>] _spin_unlock+0x17/0x20
[<ffffffff883400a6>] :jbd2:start_this_handle+0x4e0/0x4fe
[<ffffffff88366564>] :ext4dev:ext4_fallocate+0x175/0x39a
[<ffffffff81053c91>] lock_release_holdtime+0x27/0x49
[<ffffffff81056480>] __lock_acquire+0x4e7/0xc4d
[<ffffffff81053c91>] lock_release_holdtime+0x27/0x49
[<ffffffff810a8de7>] sys_fallocate+0xe4/0x10d
[<ffffffff8100c043>] tracesys+0xd5/0xda


Signed-off-by: Aneesh Kumar K.V <[email protected]>
---
fs/ext4/extents.c | 26 ++++++++++++++------------
1 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 81bce98..4269cc6 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -1029,7 +1029,7 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
{
struct ext4_extent_idx *ix;
struct ext4_extent *ex;
- int depth;
+ int depth, ee_len;

BUG_ON(path == NULL);
depth = path->p_depth;
@@ -1043,6 +1043,7 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
* first one in the file */

ex = path[depth].p_ext;
+ ee_len = ext4_ext_get_actual_len(ex);
if (*logical < le32_to_cpu(ex->ee_block)) {
BUG_ON(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex);
while (--depth >= 0) {
@@ -1052,10 +1053,10 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
return 0;
}

- BUG_ON(*logical < le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len));
+ BUG_ON(*logical < (le32_to_cpu(ex->ee_block) + ee_len));

- *logical = le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len) - 1;
- *phys = ext_pblock(ex) + le16_to_cpu(ex->ee_len) - 1;
+ *logical = le32_to_cpu(ex->ee_block) + ee_len - 1;
+ *phys = ext_pblock(ex) + ee_len - 1;
return 0;
}

@@ -1075,7 +1076,7 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
struct ext4_extent_idx *ix;
struct ext4_extent *ex;
ext4_fsblk_t block;
- int depth;
+ int depth, ee_len;

BUG_ON(path == NULL);
depth = path->p_depth;
@@ -1089,6 +1090,7 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
* first one in the file */

ex = path[depth].p_ext;
+ ee_len = ext4_ext_get_actual_len(ex);
if (*logical < le32_to_cpu(ex->ee_block)) {
BUG_ON(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex);
while (--depth >= 0) {
@@ -1100,7 +1102,7 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
return 0;
}

- BUG_ON(*logical < le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len));
+ BUG_ON(*logical < (le32_to_cpu(ex->ee_block) + ee_len));

if (ex != EXT_LAST_EXTENT(path[depth].p_hdr)) {
/* next allocated block in this leaf */
@@ -1315,7 +1317,7 @@ ext4_can_extents_be_merged(struct inode *inode, struct ext4_extent *ex1,
if (ext1_ee_len + ext2_ee_len > max_len)
return 0;
#ifdef AGGRESSIVE_TEST
- if (le16_to_cpu(ex1->ee_len) >= 4)
+ if (ext1_ee_len >= 4)
return 0;
#endif

@@ -1555,7 +1557,7 @@ has_space:
nearex = path[depth].p_ext;
nearex->ee_block = newext->ee_block;
ext4_ext_store_pblock(nearex, ext_pblock(newext));
- nearex->ee_len = newext->ee_len;
+ nearex->ee_len = ext4_ext_get_actual_len(newext);

merge:
/* try to merge extents to the right */
@@ -2310,7 +2312,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
- le32_to_cpu(newex.ee_block)
+ ext_pblock(&newex);
/* number of remaining blocks in the extent */
- allocated = le16_to_cpu(newex.ee_len) -
+ allocated = ext4_ext_get_actual_len(&newex) -
(iblock - le32_to_cpu(newex.ee_block));
goto out;
} else {
@@ -2426,7 +2428,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
newex.ee_len = cpu_to_le16(max_blocks);
err = ext4_ext_check_overlap(inode, &newex, path);
if (err)
- allocated = le16_to_cpu(newex.ee_len);
+ allocated = ext4_ext_get_actual_len(&newex);
else
allocated = max_blocks;

@@ -2458,7 +2460,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
* but otherwise we'd need to call it every free() */
ext4_mb_discard_inode_preallocations(inode);
ext4_free_blocks(handle, inode, ext_pblock(&newex),
- le16_to_cpu(newex.ee_len), 0);
+ ext4_ext_get_actual_len(&newex), 0);
goto out2;
}

@@ -2467,7 +2469,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,

/* previous routine could use block we allocated */
newblock = ext_pblock(&newex);
- allocated = le16_to_cpu(newex.ee_len);
+ allocated = ext4_ext_get_actual_len(&newex);
outnew:
__set_bit(BH_New, &bh_result->b_state);

--
1.5.4.rc2.60.gb2e62-dirty

2008-01-14 10:35:45

by Aneesh Kumar K.V

[permalink] [raw]
Subject: Re: [PATCH] ext4: use ext4_ext_get_actual_len instead of directly using ext4_extent.ee_len

On Sat, Jan 12, 2008 at 11:44:00PM +0530, Aneesh Kumar K.V wrote:
> fs/ext4/extents.c | 26 ++++++++++++++------------
> 1 files changed, 14 insertions(+), 12 deletions(-)
>
> diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
> index 81bce98..4269cc6 100644
> --- a/fs/ext4/extents.c
> +++ b/fs/ext4/extents.c
> @@ -1029,7 +1029,7 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
> {
> struct ext4_extent_idx *ix;
> struct ext4_extent *ex;
> - int depth;
> + int depth, ee_len;
>
> BUG_ON(path == NULL);
> depth = path->p_depth;
> @@ -1043,6 +1043,7 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
> * first one in the file */
>
> ex = path[depth].p_ext;
> + ee_len = ext4_ext_get_actual_len(ex);
> if (*logical < le32_to_cpu(ex->ee_block)) {
> BUG_ON(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex);
> while (--depth >= 0) {
> @@ -1052,10 +1053,10 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
> return 0;
> }
>
> - BUG_ON(*logical < le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len));
> + BUG_ON(*logical < (le32_to_cpu(ex->ee_block) + ee_len));
>
> - *logical = le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len) - 1;
> - *phys = ext_pblock(ex) + le16_to_cpu(ex->ee_len) - 1;
> + *logical = le32_to_cpu(ex->ee_block) + ee_len - 1;
> + *phys = ext_pblock(ex) + ee_len - 1;
> return 0;
> }
>
> @@ -1075,7 +1076,7 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
> struct ext4_extent_idx *ix;
> struct ext4_extent *ex;
> ext4_fsblk_t block;
> - int depth;
> + int depth, ee_len;
>
> BUG_ON(path == NULL);
> depth = path->p_depth;
> @@ -1089,6 +1090,7 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
> * first one in the file */
>
> ex = path[depth].p_ext;
> + ee_len = ext4_ext_get_actual_len(ex);
> if (*logical < le32_to_cpu(ex->ee_block)) {
> BUG_ON(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex);
> while (--depth >= 0) {
> @@ -1100,7 +1102,7 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
> return 0;
> }
>
> - BUG_ON(*logical < le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len));
> + BUG_ON(*logical < (le32_to_cpu(ex->ee_block) + ee_len));
>
> if (ex != EXT_LAST_EXTENT(path[depth].p_hdr)) {
> /* next allocated block in this leaf */
> @@ -1315,7 +1317,7 @@ ext4_can_extents_be_merged(struct inode *inode, struct ext4_extent *ex1,
> if (ext1_ee_len + ext2_ee_len > max_len)
> return 0;
> #ifdef AGGRESSIVE_TEST
> - if (le16_to_cpu(ex1->ee_len) >= 4)
> + if (ext1_ee_len >= 4)
> return 0;
> #endif
>
> @@ -1555,7 +1557,7 @@ has_space:
> nearex = path[depth].p_ext;
> nearex->ee_block = newext->ee_block;
> ext4_ext_store_pblock(nearex, ext_pblock(newext));
> - nearex->ee_len = newext->ee_len;
> + nearex->ee_len = ext4_ext_get_actual_len(newext);
>
> merge:
> /* try to merge extents to the right */

This change is not needed. ext4_ext_try_to_merge check whether the
extent is uninitialized or not and zero out the blocks if we are
merging.

> @@ -2310,7 +2312,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
> - le32_to_cpu(newex.ee_block)
> + ext_pblock(&newex);
> /* number of remaining blocks in the extent */

New patch is attached below.

-aneesh


Attachments:
(No filename) (3.27 kB)
ext4_get_extent_length_fix.patch (4.67 kB)
Download all attachments