Re: [PATCH] fio: make sure io_u->file isn't NULL before using it

[Jens Axboe <axboe@kernel.dk>]

On 10/11/21 7:44 AM, Luís Henriques wrote:
> On Mon, Oct 11, 2021 at 06:58:52AM -0600, Jens Axboe wrote:
>> On 10/11/21 4:27 AM, Luís Henriques wrote:
>>> While running fstests generic/095 against ext4 on a zram device I started
>>> seeing fio crashing.  Fix it by making sure io_u->file isn't NULL before
>>> accessing it.
>>>
>>> Signed-off-by: Luís Henriques <lhenriques@suse.de>
>>> ---
>>>  io_u.c | 3 ++-
>>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/io_u.c b/io_u.c
>>> index 5289b5d1d9c6..b8e715d4118c 100644
>>> --- a/io_u.c
>>> +++ b/io_u.c
>>> @@ -2009,7 +2009,8 @@ static void io_completed(struct thread_data *td, struct io_u **io_u_ptr,
>>>  			io_u->xfer_buf += bytes;
>>>  			io_u->offset += bytes;
>>>  			td->ts.short_io_u[io_u->ddir]++;
>>> -			if (io_u->offset < io_u->file->real_file_size) {
>>> +			if (io_u->file &&
>>> +			    (io_u->offset < io_u->file->real_file_size)) {
>>>  				requeue_io_u(td, io_u_ptr);
>>>  				return;
>>>  			}
>>
>> This will prevent the crash, but I'm wondering why io_u-> == NULL for this case.
>> It really should be a valid file.
>>
>> Can you let me know exactly how you're reproducing this? Then I'll give it
>> a whirl too.
> 
> Sure, here's my recipe for reproducing this bug:
> 
>  # modprobe zram num_devices=2
>  # echo 1G > /sys/block/zram0/disksize 
>  # echo 1G > /sys/block/zram1/disksize 
>  # mkfs.ext4 /dev/zram0
>  # mkfs.ext4 /dev/zram1
> 
>  # ./check generic/095

I know you fixed the issue in the test by now, but any chance you can try
this one and see if it correctly reports full residual instead of trying
to requeue and crash?


diff --git a/io_u.c b/io_u.c
index 5289b5d1d9c6..586a4befdce0 100644
--- a/io_u.c
+++ b/io_u.c
@@ -2004,7 +2004,7 @@ static void io_completed(struct thread_data *td, struct io_u **io_u_ptr,
 		 * Make sure we notice short IO from here, and requeue them
 		 * appropriately!
 		 */
-		if (io_u->resid) {
+		if (bytes && io_u->resid) {
 			io_u->xfer_buflen = io_u->resid;
 			io_u->xfer_buf += bytes;
 			io_u->offset += bytes;

-- 
Jens Axboe