linux/fs/ocfs2
Shuning Zhang e091eab028 ocfs2: fix ocfs2 read inode data panic in ocfs2_iget
In some cases, ocfs2_iget() reads the data of inode, which has been
deleted for some reason.  That will make the system panic.  So We should
judge whether this inode has been deleted, and tell the caller that the
inode is a bad inode.

For example, the ocfs2 is used as the backed of nfs, and the client is
nfsv3.  This issue can be reproduced by the following steps.

on the nfs server side,
..../patha/pathb

Step 1: The process A was scheduled before calling the function fh_verify.

Step 2: The process B is removing the 'pathb', and just completed the call
to function dput.  Then the dentry of 'pathb' has been deleted from the
dcache, and all ancestors have been deleted also.  The relationship of
dentry and inode was deleted through the function hlist_del_init.  The
following is the call stack.
dentry_iput->hlist_del_init(&dentry->d_u.d_alias)

At this time, the inode is still in the dcache.

Step 3: The process A call the function ocfs2_get_dentry, which get the
inode from dcache.  Then the refcount of inode is 1.  The following is the
call stack.
nfsd3_proc_getacl->fh_verify->exportfs_decode_fh->fh_to_dentry(ocfs2_get_dentry)

Step 4: Dirty pages are flushed by bdi threads.  So the inode of 'patha'
is evicted, and this directory was deleted.  But the inode of 'pathb'
can't be evicted, because the refcount of the inode was 1.

Step 5: The process A keep running, and call the function
reconnect_path(in exportfs_decode_fh), which call function
ocfs2_get_parent of ocfs2.  Get the block number of parent
directory(patha) by the name of ...  Then read the data from disk by the
block number.  But this inode has been deleted, so the system panic.

Process A                                             Process B
1. in nfsd3_proc_getacl                   |
2.                                        |        dput
3. fh_to_dentry(ocfs2_get_dentry)         |
4. bdi flush dirty cache                  |
5. ocfs2_iget                             |

[283465.542049] OCFS2: ERROR (device sdp): ocfs2_validate_inode_block:
Invalid dinode #580640: OCFS2_VALID_FL not set

[283465.545490] Kernel panic - not syncing: OCFS2: (device sdp): panic forced
after error

[283465.546889] CPU: 5 PID: 12416 Comm: nfsd Tainted: G        W
4.1.12-124.18.6.el6uek.bug28762940v3.x86_64 #2
[283465.548382] Hardware name: VMware, Inc. VMware Virtual Platform/440BX
Desktop Reference Platform, BIOS 6.00 09/21/2015
[283465.549657]  0000000000000000 ffff8800a56fb7b8 ffffffff816e839c
ffffffffa0514758
[283465.550392]  000000000008dc20 ffff8800a56fb838 ffffffff816e62d3
0000000000000008
[283465.551056]  ffff880000000010 ffff8800a56fb848 ffff8800a56fb7e8
ffff88005df9f000
[283465.551710] Call Trace:
[283465.552516]  [<ffffffff816e839c>] dump_stack+0x63/0x81
[283465.553291]  [<ffffffff816e62d3>] panic+0xcb/0x21b
[283465.554037]  [<ffffffffa04e66b0>] ocfs2_handle_error+0xf0/0xf0 [ocfs2]
[283465.554882]  [<ffffffffa04e7737>] __ocfs2_error+0x67/0x70 [ocfs2]
[283465.555768]  [<ffffffffa049c0f9>] ocfs2_validate_inode_block+0x229/0x230
[ocfs2]
[283465.556683]  [<ffffffffa047bcbc>] ocfs2_read_blocks+0x46c/0x7b0 [ocfs2]
[283465.557408]  [<ffffffffa049bed0>] ? ocfs2_inode_cache_io_unlock+0x20/0x20
[ocfs2]
[283465.557973]  [<ffffffffa049f0eb>] ocfs2_read_inode_block_full+0x3b/0x60
[ocfs2]
[283465.558525]  [<ffffffffa049f5ba>] ocfs2_iget+0x4aa/0x880 [ocfs2]
[283465.559082]  [<ffffffffa049146e>] ocfs2_get_parent+0x9e/0x220 [ocfs2]
[283465.559622]  [<ffffffff81297c05>] reconnect_path+0xb5/0x300
[283465.560156]  [<ffffffff81297f46>] exportfs_decode_fh+0xf6/0x2b0
[283465.560708]  [<ffffffffa062faf0>] ? nfsd_proc_getattr+0xa0/0xa0 [nfsd]
[283465.561262]  [<ffffffff810a8196>] ? prepare_creds+0x26/0x110
[283465.561932]  [<ffffffffa0630860>] fh_verify+0x350/0x660 [nfsd]
[283465.562862]  [<ffffffffa0637804>] ? nfsd_cache_lookup+0x44/0x630 [nfsd]
[283465.563697]  [<ffffffffa063a8b9>] nfsd3_proc_getattr+0x69/0xf0 [nfsd]
[283465.564510]  [<ffffffffa062cf60>] nfsd_dispatch+0xe0/0x290 [nfsd]
[283465.565358]  [<ffffffffa05eb892>] ? svc_tcp_adjust_wspace+0x12/0x30
[sunrpc]
[283465.566272]  [<ffffffffa05ea652>] svc_process_common+0x412/0x6a0 [sunrpc]
[283465.567155]  [<ffffffffa05eaa03>] svc_process+0x123/0x210 [sunrpc]
[283465.568020]  [<ffffffffa062c90f>] nfsd+0xff/0x170 [nfsd]
[283465.568962]  [<ffffffffa062c810>] ? nfsd_destroy+0x80/0x80 [nfsd]
[283465.570112]  [<ffffffff810a622b>] kthread+0xcb/0xf0
[283465.571099]  [<ffffffff810a6160>] ? kthread_create_on_node+0x180/0x180
[283465.572114]  [<ffffffff816f11b8>] ret_from_fork+0x58/0x90
[283465.573156]  [<ffffffff810a6160>] ? kthread_create_on_node+0x180/0x180

Link: http://lkml.kernel.org/r/1554185919-3010-1-git-send-email-sunny.s.zhang@oracle.com
Signed-off-by: Shuning Zhang <sunny.s.zhang@oracle.com>
Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: piaojun <piaojun@huawei.com>
Cc: "Gang He" <ghe@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-05-14 09:47:44 -07:00
..
cluster fs: mark expected switch fall-throughs 2019-04-08 18:21:02 -05:00
dlm ocfs2: improve ocfs2 Makefile 2018-12-28 12:11:45 -08:00
dlmfs dlmfs: switch to ->free_inode() 2019-05-01 22:43:25 -04:00
acl.c ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute 2018-01-31 17:18:35 -08:00
acl.h ocfs2: make ocfs2_set_acl() static 2017-09-06 17:27:24 -07:00
alloc.c ocfs2: fix the application IO timeout when fstrim is running 2019-03-05 21:07:13 -08:00
alloc.h ocfs2: try to reuse extent block in dealloc without meta_alloc 2018-01-31 17:18:35 -08:00
aops.c fs: don't open code lru_to_page() 2019-01-04 13:13:48 -08:00
aops.h ocfs2: keep the trace point consistent with the function name 2018-04-05 21:36:21 -07:00
blockcheck.c
blockcheck.h
buffer_head_io.c ocfs2: don't clear bh uptodate for block read 2018-12-28 12:11:46 -08:00
buffer_head_io.h ocfs2: clean up some unused function declarations 2017-11-15 18:21:01 -08:00
dcache.c
dcache.h
dir.c ocfs2: use common file type conversion 2019-05-14 09:47:44 -07:00
dir.h
dlmglue.c ocfs2: fix the application IO timeout when fstrim is running 2019-03-05 21:07:13 -08:00
dlmglue.h ocfs2: ocfs2_inode_lock_tracker does not distinguish lock level 2018-06-07 17:34:33 -07:00
export.c ocfs2: fix ocfs2 read inode data panic in ocfs2_iget 2019-05-14 09:47:44 -07:00
export.h
extent_map.c ocfs2: add ocfs2_overwrite_io() 2018-01-31 17:18:35 -08:00
extent_map.h ocfs2: add ocfs2_overwrite_io() 2018-01-31 17:18:35 -08:00
file.c ocfs2: don't use iocb when EIOCBQUEUED returns 2018-11-03 10:09:37 -07:00
file.h ocfs2: clean up redundant function declarations 2018-06-07 17:34:33 -07:00
filecheck.c ocfs2: add duplicated ino number check 2018-04-05 21:36:22 -07:00
filecheck.h ocfs2: add kobject for online file check 2018-04-05 21:36:22 -07:00
heartbeat.c
heartbeat.h
inode.c ocfs2: clean up some unnecessary code 2018-08-17 16:20:27 -07:00
inode.h ocfs2: convert inode refcount test to a helper 2016-12-10 12:39:45 -08:00
ioctl.c ocfs2: eliminate a misreported warning 2018-06-07 17:34:33 -07:00
ioctl.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
journal.c ocfs2: clear journal dirty flag after shutdown journal 2018-12-28 12:11:45 -08:00
journal.h jbd2: add support for avoiding data writes during transaction commits 2016-04-24 00:56:07 -04:00
Kconfig
localalloc.c ocfs2: fix panic due to unrecovered local alloc 2018-12-28 12:11:45 -08:00
localalloc.h
locks.c ocfs2: properly initial file_lock used for unlock. 2018-11-30 11:26:12 -05:00
locks.h
Makefile ocfs2: improve ocfs2 Makefile 2018-12-28 12:11:45 -08:00
mmap.c fs: ocfs2: use new return type vm_fault_t 2018-06-07 17:34:34 -07:00
mmap.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
move_extents.c ocfs2: fix deadlock caused by ocfs2_defrag_extent() 2018-11-30 14:56:13 -08:00
move_extents.h
namei.c ocfs2: drop a VLA in ocfs2_orphan_del() 2018-06-07 17:34:34 -07:00
namei.h
ocfs1_fs_compat.h
ocfs2_fs.h ocfs2: use common file type conversion 2019-05-14 09:47:44 -07:00
ocfs2_ioctl.h
ocfs2_lockid.h ocfs2: add trimfs dlm lock resource 2018-01-31 17:18:35 -08:00
ocfs2_lockingver.h
ocfs2_trace.h ocfs2: fix the application IO timeout when fstrim is running 2019-03-05 21:07:13 -08:00
ocfs2.h ocfs2: fix the application IO timeout when fstrim is running 2019-03-05 21:07:13 -08:00
quota_global.c ocfs2: convert to new i_version API 2018-01-29 06:42:21 -05:00
quota_local.c ocfs2: return -EROFS when filesystem becomes read-only 2018-08-17 16:20:27 -07:00
quota.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
refcounttree.c ocfs2: fix inode bh swapping mixup in ocfs2_reflink_inodes_lock 2019-03-29 10:01:37 -07:00
refcounttree.h ocfs2: remove ocfs2_reflink_remap_range 2018-10-30 10:45:48 +11:00
reservations.c
reservations.h
resize.c ocfs2: solve a problem of crossing the boundary in updating backups 2016-03-25 16:37:42 -07:00
resize.h
slot_map.c ocfs2: Use zero-sized array and struct_size() in kzalloc() 2019-03-05 21:07:13 -08:00
slot_map.h
stack_o2cb.c
stack_user.c treewide: Align function definition open/close braces 2018-03-26 11:13:09 +02:00
stackglue.c ocfs2: remove ocfs2_is_o2cb_active() 2018-11-03 10:09:37 -07:00
stackglue.h ocfs2: remove ocfs2_is_o2cb_active() 2018-11-03 10:09:37 -07:00
suballoc.c ocfs2: remove two unused functions from suballoc.c 2018-04-05 21:36:22 -07:00
suballoc.h
super.c for-5.2/block-20190507 2019-05-07 18:14:36 -07:00
super.h ocfs2: remove unused declaration ocfs2_publish_get_mount_state() 2017-11-15 18:21:01 -08:00
symlink.c vfs: remove ".readlink = generic_readlink" assignments 2016-12-09 16:45:04 +01:00
symlink.h
sysfile.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
sysfile.h
uptodate.c ocfs2: remove unnecessary null pointer check before kmem_cache_destroy() 2018-04-05 21:36:22 -07:00
uptodate.h
xattr.c ocfs2: use 'osb' instead of 'OCFS2_SB()' 2018-04-05 21:36:21 -07:00
xattr.h ocfs2: fix posix_acl_create deadlock 2016-05-12 15:52:50 -07:00