Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 31 Jul 2023 18:15:00 +0200
From:   Jan Kara <jack@suse.cz>
To:     Zhang Yi <yi.zhang@huaweicloud.com>
Cc:     linux-ext4@vger.kernel.org, tytso@mit.edu,
        adilger.kernel@dilger.ca, jack@suse.cz, yi.zhang@huawei.com,
        chengzhihao1@huawei.com, yang.lee@linux.alibaba.com,
        yukuai3@huawei.com
Subject: Re: [PATCH 2/3] jbd2: Check 'jh->b_transaction' before remove it
 from checkpoint
Message-ID: <20230731161500.dm7nf3kpxbvfxa5y@quack3>
References: <20230714025528.564988-1-yi.zhang@huaweicloud.com>
 <20230714025528.564988-3-yi.zhang@huaweicloud.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20230714025528.564988-3-yi.zhang@huaweicloud.com>
Precedence: bulk

On Fri 14-07-23 10:55:27, Zhang Yi wrote:
> From: Zhihao Cheng <chengzhihao1@huawei.com>
> 
> Following process will corrupt ext4 image:
> Step 1:
> jbd2_journal_commit_transaction
>  __jbd2_journal_insert_checkpoint(jh, commit_transaction)
>  // Put jh into trans1->t_checkpoint_list
>  journal->j_checkpoint_transactions = commit_transaction
>  // Put trans1 into journal->j_checkpoint_transactions
> 
> Step 2:
> do_get_write_access
>  test_clear_buffer_dirty(bh) // clear buffer dirty，set jbd dirty
>  __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2
> 
> Step 3:
> drop_cache
>  journal_shrink_one_cp_list
>   jbd2_journal_try_remove_checkpoint
>    if (!trylock_buffer(bh))  // lock bh, true
>    if (buffer_dirty(bh))     // buffer is not dirty
>    __jbd2_journal_remove_checkpoint(jh)
>    // remove jh from trans1->t_checkpoint_list
> 
> Step 4:
> jbd2_log_do_checkpoint
>  trans1 = journal->j_checkpoint_transactions
>  // jh is not in trans1->t_checkpoint_list
>  jbd2_cleanup_journal_tail(journal)  // trans1 is done
> 
> Step 5: Power cut, trans2 is not committed, jh is lost in next mounting.
> 
> Fix it by checking 'jh->b_transaction' before remove it from checkpoint.
> 
> Fixes: 46f881b5b175 ("jbd2: fix a race when checking checkpoint buffer busy")
> Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
> Signed-off-by: Zhang Yi <yi.zhang@huawei.com>

Indeed! I've missed this difference between __cp_buffer_busy() and
jbd2_journal_try_remove_checkpoint() during my review of 46f881b5b175. The
fix looks good. Feel free to add:

Reviewed-by: Jan Kara <jack@suse.cz>

								Honza

> ---
>  fs/jbd2/checkpoint.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
> index 936c6d758a65..f033ac807013 100644
> --- a/fs/jbd2/checkpoint.c
> +++ b/fs/jbd2/checkpoint.c
> @@ -639,6 +639,8 @@ int jbd2_journal_try_remove_checkpoint(struct journal_head *jh)
>  {
>  	struct buffer_head *bh = jh2bh(jh);
>  
> +	if (jh->b_transaction)
> +		return -EBUSY;
>  	if (!trylock_buffer(bh))
>  		return -EBUSY;
>  	if (buffer_dirty(bh)) {
> -- 
> 2.39.2
> 
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR