• Kent Overstreet's avatar
    bcachefs: Clear btree_node_just_written() when node reused or evicted · 0b438c5b
    Kent Overstreet authored
    This fixes the following bug:
    
    Journal reclaim attempts to flush a node, but races with the node being
    evicted from the btree node cache; when we lock the node, the data
    buffers have already been freed.
    
    We don't evict a node that's dirty, so calling btree_node_write() is
    fine - it's a noop - except that the btree_node_just_written bit causes
    bch2_btree_post_write_cleanup() to run (resorting the node), which then
    causes a null ptr deref.
    
    00078 Unable to handle kernel NULL pointer dereference at virtual address 000000000000009e
    00078 Mem abort info:
    00078   ESR = 0x0000000096000005
    00078   EC = 0x25: DABT (current EL), IL = 32 bits
    00078   SET = 0, FnV = 0
    00078   EA = 0, S1PTW = 0
    00078   FSC = 0x05: level 1 translation fault
    00078 Data abort info:
    00078   ISV = 0, ISS = 0x00000005
    00078   CM = 0, WnR = 0
    00078 user pgtable: 4k pages, 39-bit VAs, pgdp=000000007ed64000
    00078 [000000000000009e] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
    00078 Internal error: Oops: 0000000096000005 [#1] SMP
    00078 Modules linked in:
    00078 CPU: 75 PID: 1170 Comm: stress-ng-utime Not tainted 6.3.0-ktest-g5ef5b466e77e #2078
    00078 Hardware name: linux,dummy-virt (DT)
    00078 pstate: 80001005 (Nzcv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--)
    00078 pc : btree_node_sort+0xc4/0x568
    00078 lr : bch2_btree_post_write_cleanup+0x6c/0x1c0
    00078 sp : ffffff803e30b350
    00078 x29: ffffff803e30b350 x28: 0000000000000001 x27: ffffff80076e52a8
    00078 x26: 0000000000000002 x25: 0000000000000000 x24: ffffffc00912e000
    00078 x23: ffffff80076e52a8 x22: 0000000000000000 x21: ffffff80076e52bc
    00078 x20: ffffff80076e5200 x19: 0000000000000000 x18: 0000000000000000
    00078 x17: fffffffff8000000 x16: 0000000008000000 x15: 0000000008000000
    00078 x14: 0000000000000002 x13: 0000000000000000 x12: 00000000000000a0
    00078 x11: ffffff803e30b400 x10: ffffff803e30b408 x9 : 0000000000000001
    00078 x8 : 0000000000000000 x7 : ffffff803e480000 x6 : 00000000000000a0
    00078 x5 : 0000000000000088 x4 : 0000000000000000 x3 : 0000000000000010
    00078 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff80076e52a8
    00078 Call trace:
    00078  btree_node_sort+0xc4/0x568
    00078  bch2_btree_post_write_cleanup+0x6c/0x1c0
    00078  bch2_btree_node_write+0x108/0x148
    00078  __btree_node_flush+0x104/0x160
    00078  bch2_btree_node_flush0+0x1c/0x30
    00078  journal_flush_pins.constprop.0+0x184/0x2d0
    00078  __bch2_journal_reclaim+0x4d4/0x508
    00078  bch2_journal_reclaim+0x1c/0x30
    00078  __bch2_journal_preres_get+0x244/0x268
    00078  bch2_trans_journal_preres_get_cold+0xa4/0x180
    00078  __bch2_trans_commit+0x61c/0x1bb0
    00078  bch2_setattr_nonsize+0x254/0x318
    00078  bch2_setattr+0x5c/0x78
    00078  notify_change+0x2bc/0x408
    00078  vfs_utimes+0x11c/0x218
    00078  do_utimes+0x84/0x140
    00078  __arm64_sys_utimensat+0x68/0xa8
    00078  invoke_syscall.constprop.0+0x54/0xf0
    00078  do_el0_svc+0x48/0xd8
    00078  el0_svc+0x14/0x48
    00078  el0t_64_sync_handler+0xb0/0xb8
    00078  el0t_64_sync+0x14c/0x150
    00078 Code: 8b050265 910020c6 8b060266 910060ac (79402cad)
    00078 ---[ end trace 0000000000000000 ]---
    Signed-off-by: default avatarKent Overstreet <kent.overstreet@linux.dev>
    0b438c5b
btree_cache.c 29.3 KB