[RFC PATCH v2 0/3] btrfs: add error injection support for checksum verification

[RFC PATCH v2 0/3] btrfs: add error injection support for checksum verification

[Song Chen]

This patchset adds fault injection support for btrfs_data_csum_ok,
enabling controlled simulation of checksum mismatches to test btrfs
silent data corruption detection and reporting paths.

The first patch extends the error injection framework with a new type,
EI_ETYPE_FALSE, which allows bool-returning functions to be overridden
with a false return value directly.

The second patch marks btrfs_data_csum_ok with ALLOW_ERROR_INJECTION
using this new type.

The third patch adds a parent field to fei_attr to allow fault injection
on a function only when called from a specific parent function. 

Song Chen (3):
  error-injection: Introduce EI_ETYPE_FALSE for fail_function
  btrfs: Allow error injection on btrfs_data_csum_ok
  error-injection: Introduce parent in fei_attr

 arch/arm/lib/error-inject.c           |  6 ++
 arch/arm64/lib/error-inject.c         |  6 ++
 arch/csky/lib/error-inject.c          |  6 ++
 arch/loongarch/lib/error-inject.c     |  6 ++
 arch/powerpc/lib/error-inject.c       |  6 ++
 arch/riscv/lib/error-inject.c         |  6 ++
 arch/s390/lib/error-inject.c          |  6 ++
 arch/x86/lib/error-inject.c           |  6 ++
 fs/btrfs/inode.c                      |  1 +
 include/asm-generic/error-injection.h |  6 ++
 kernel/fail_function.c                | 98 ++++++++++++++++++++++++++-
 11 files changed, 152 insertions(+), 1 deletion(-)

---
changelog:
v1 --- v2:
Add a parent field to struct fei_attr.

-- 
2.43.0

[RFC PATCH v2 1/3] error-injection: Introduce EI_ETYPE_FALSE for fail_function

[Song Chen]

Introduce EI_ETYPE_FALSE for functions which need false as return
value in their error-injections, like btrfs_data_csum_ok.

EI_ETYPE_NULL can return 0 too but its readability is not good
enough.

Signed-off-by: Song Chen <chensong_2000@126.com>
---
 include/asm-generic/error-injection.h | 1 +
 kernel/fail_function.c                | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/include/asm-generic/error-injection.h b/include/asm-generic/error-injection.h
index b05253f68eaa..6c399121ab7a 100644
--- a/include/asm-generic/error-injection.h
+++ b/include/asm-generic/error-injection.h
@@ -8,6 +8,7 @@ enum {
 	EI_ETYPE_ERRNO,		/* Return -ERRNO if failure */
 	EI_ETYPE_ERRNO_NULL,	/* Return -ERRNO or NULL if failure */
 	EI_ETYPE_TRUE,		/* Return true if failure */
+	EI_ETYPE_FALSE,		/* Return false if failure */
 };
 
 struct error_injection_entry {
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 2eaf55005f49..90cdad0412cd 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -48,6 +48,8 @@ static unsigned long adjust_error_retval(unsigned long addr, unsigned long retv)
 		break;
 	case EI_ETYPE_TRUE:
 		return 1;
+	case EI_ETYPE_FALSE:
+		return 0;
 	}
 
 	return retv;
-- 
2.43.0

[RFC PATCH v2 2/3] btrfs: Allow error injection on btrfs_data_csum_ok

[Song Chen]

btrfs_data_csum_ok validates the checksum of a data block
after a read I/O completes. A mismatch between the on-disk
checksum and the one computed from the read data indicates
silent data corruption, which can be caused by bit flips due
to DRAM errors, storage media degradation, or bus transmission
faults.

Testing the error handling path that responds to such
corruption, including any warning output and uspace
notification, normally requires reproducing the hardware
fault, which is not always feasible.

Mark btrfs_data_csum_ok with ALLOW_ERROR_INJECTION so that
the fail_function infrastructure can override its return value
to false, simulating a checksum mismatch without requiring
actual data corruption. This enables validation of the full
error detection and reporting path in a controlled environment.

Usage:
        cd /sys/kernel/debug/fail_function
        echo btrfs_data_csum_ok > inject
        echo 0 > btrfs_data_csum_ok/retval
        echo 100 > probability
        echo N > times

Signed-off-by: Song Chen <chensong_2000@126.com>
---
 fs/btrfs/inode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 906d5c21ebc4..6be3e920b954 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3574,6 +3574,7 @@ bool btrfs_data_csum_ok(struct btrfs_bio *bbio, struct btrfs_device *dev,
 		memzero_page(phys_to_page(paddrs[i]), offset_in_page(paddrs[i]), step);
 	return false;
 }
+ALLOW_ERROR_INJECTION(btrfs_data_csum_ok, FALSE);
 
 /*
  * Perform a delayed iput on @inode.
-- 
2.43.0

[RFC PATCH v2 3/3] error-injection: Introduce parent in fei_attr

[Song Chen]

Add a parent field to fei_attr to allow fault injection on a function
only when called from a specific parent function. This enables more
precise fault injection control, for example, injecting failures into
btrfs_data_csum_ok() only when called from btrfs_check_read_bio(),
not from btrfs_end_repair_bio().

Introduce fei_return_address() in each architecture's error-injection.c
(x86, arm64, riscv, loongarch) to retrieve the return address from
pt_regs in a kprobe handler, following the same pattern as the existing
override_function_with_return(). A new parent debugfs file is added
under /sys/kernel/debug/fail_function/<func>/ to configure the filter.

Usage:
  echo "btrfs_data_csum_ok" > /sys/kernel/debug/fail_function/inject
  echo 0   > /sys/kernel/debug/fail_function/btrfs_data_csum_ok/retval
  echo 100 > /sys/kernel/debug/fail_function/probability
  echo 10  > /sys/kernel/debug/fail_function/times
  echo "btrfs_check_read_bio" > \
      /sys/kernel/debug/fail_function/btrfs_data_csum_ok/parent

  To clear the parent filter:
  echo "" > /sys/kernel/debug/fail_function/btrfs_data_csum_ok/parent

Signed-off-by: Song Chen <chensong_2000@126.com>
---
 arch/arm/lib/error-inject.c           |  6 ++
 arch/arm64/lib/error-inject.c         |  6 ++
 arch/csky/lib/error-inject.c          |  6 ++
 arch/loongarch/lib/error-inject.c     |  6 ++
 arch/powerpc/lib/error-inject.c       |  6 ++
 arch/riscv/lib/error-inject.c         |  6 ++
 arch/s390/lib/error-inject.c          |  6 ++
 arch/x86/lib/error-inject.c           |  6 ++
 include/asm-generic/error-injection.h |  5 ++
 kernel/fail_function.c                | 96 ++++++++++++++++++++++++++-
 10 files changed, 148 insertions(+), 1 deletion(-)

diff --git a/arch/arm/lib/error-inject.c b/arch/arm/lib/error-inject.c
index 5a5b405792ba..1f7a482555ea 100644
--- a/arch/arm/lib/error-inject.c
+++ b/arch/arm/lib/error-inject.c
@@ -8,3 +8,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, regs->ARM_lr);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->ARM_lr;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/arm64/lib/error-inject.c b/arch/arm64/lib/error-inject.c
index ed15021da3ed..ccd33c92bb37 100644
--- a/arch/arm64/lib/error-inject.c
+++ b/arch/arm64/lib/error-inject.c
@@ -16,3 +16,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, procedure_link_pointer(regs));
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return procedure_link_pointer(regs);
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/csky/lib/error-inject.c b/arch/csky/lib/error-inject.c
index c15fb36fe067..c7a1b3948c76 100644
--- a/arch/csky/lib/error-inject.c
+++ b/arch/csky/lib/error-inject.c
@@ -8,3 +8,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, regs->lr);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->lr;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/loongarch/lib/error-inject.c b/arch/loongarch/lib/error-inject.c
index afc9e1c7c973..844356fef828 100644
--- a/arch/loongarch/lib/error-inject.c
+++ b/arch/loongarch/lib/error-inject.c
@@ -8,3 +8,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, regs->regs[1]);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->regs[1];
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/powerpc/lib/error-inject.c b/arch/powerpc/lib/error-inject.c
index e834079d2b5c..c72abce5d19f 100644
--- a/arch/powerpc/lib/error-inject.c
+++ b/arch/powerpc/lib/error-inject.c
@@ -14,3 +14,9 @@ void override_function_with_return(struct pt_regs *regs)
 	regs_set_return_ip(regs, regs->link);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->link;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/riscv/lib/error-inject.c b/arch/riscv/lib/error-inject.c
index d667ade2bc41..ed8b17acc379 100644
--- a/arch/riscv/lib/error-inject.c
+++ b/arch/riscv/lib/error-inject.c
@@ -8,3 +8,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, regs->ra);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->ra;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/s390/lib/error-inject.c b/arch/s390/lib/error-inject.c
index 8c9d4da87eef..15b23076ebeb 100644
--- a/arch/s390/lib/error-inject.c
+++ b/arch/s390/lib/error-inject.c
@@ -12,3 +12,9 @@ void override_function_with_return(struct pt_regs *regs)
 	regs->psw.addr = regs->gprs[14];
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->gprs[14];
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/x86/lib/error-inject.c b/arch/x86/lib/error-inject.c
index 512a2538596f..85cc46e2dd7c 100644
--- a/arch/x86/lib/error-inject.c
+++ b/arch/x86/lib/error-inject.c
@@ -23,3 +23,9 @@ void override_function_with_return(struct pt_regs *regs)
 	regs->ip = (unsigned long)&just_return_func;
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return *(unsigned long *)regs->sp;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/include/asm-generic/error-injection.h b/include/asm-generic/error-injection.h
index 6c399121ab7a..8f526d76cdcb 100644
--- a/include/asm-generic/error-injection.h
+++ b/include/asm-generic/error-injection.h
@@ -34,10 +34,15 @@ static struct error_injection_entry __used				\
 	}
 
 void override_function_with_return(struct pt_regs *regs);
+unsigned long fei_return_address(struct pt_regs *regs);
 #else
 #define ALLOW_ERROR_INJECTION(fname, _etype)
 
 static inline void override_function_with_return(struct pt_regs *regs) { }
+static inline unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return 0UL;
+}
 #endif
 #endif
 
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 90cdad0412cd..a336fc565dc9 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -27,6 +27,9 @@ struct fei_attr {
 	struct list_head list;
 	struct kprobe kp;
 	unsigned long retval;
+	char	parent[KSYM_NAME_LEN];
+	unsigned long	parent_start;
+	unsigned long	parent_end;
 };
 static DEFINE_MUTEX(fei_lock);
 static LIST_HEAD(fei_attr_list);
@@ -154,13 +157,94 @@ static int fei_retval_get(void *data, u64 *val)
 DEFINE_DEBUGFS_ATTRIBUTE(fei_retval_ops, fei_retval_get, fei_retval_set,
 			 "%llx\n");
 
+static ssize_t fei_parent_read(struct file *file, char __user *buf,
+				 size_t count, loff_t *ppos)
+{
+	struct fei_attr *attr = file->private_data;
+	char tmp[KSYM_NAME_LEN + 1];
+	int len;
+	int err = 0;
+
+	mutex_lock(&fei_lock);
+	if (!fei_attr_is_valid(attr)) {
+		err = -ENOENT;
+		goto out;
+	}
+	len = scnprintf(tmp, sizeof(tmp), "%s\n", attr->parent);
+	mutex_unlock(&fei_lock);
+
+	return simple_read_from_buffer(buf, count, ppos, tmp, len);
+out:
+	mutex_unlock(&fei_lock);
+	return err;
+}
+
+static ssize_t fei_parent_write(struct file *file, const char __user *buf,
+				 size_t count, loff_t *ppos)
+{
+	struct fei_attr *attr = file->private_data;
+	char tmp[KSYM_NAME_LEN];
+	unsigned long start, size;
+	ssize_t err = 0;
+
+	if (count == 0 || count >= sizeof(tmp))
+		return -EINVAL;
+
+	if (copy_from_user(tmp, buf, count))
+		return -EFAULT;
+
+	tmp[count] = '\0';
+	strim(tmp);
+
+	mutex_lock(&fei_lock);
+	if (!fei_attr_is_valid(attr)) {
+		err = -ENOENT;
+		goto out;
+	}
+
+	if (tmp[0] == '\0') {
+		attr->parent[0]  = '\0';
+		attr->parent_start = 0;
+		attr->parent_end   = 0;
+		err = count;
+		goto out;
+	}
+
+	start = kallsyms_lookup_name(tmp);
+	if (!start) {
+		err = -EINVAL;
+		goto out;
+	}
+
+	if (!kallsyms_lookup_size_offset(start, &size, NULL)) {
+		err = -EINVAL;
+		goto out;
+	}
+
+	strscpy(attr->parent, tmp, sizeof(attr->parent));
+	attr->parent_start = start;
+	attr->parent_end   = start + size;
+	err = count;
+
+out:
+	mutex_unlock(&fei_lock);
+	return err;
+}
+
+static const struct file_operations fei_parent_ops = {
+	.owner = THIS_MODULE,
+	.open  = simple_open,
+	.read  = fei_parent_read,
+	.write = fei_parent_write,
+};
+
 static void fei_debugfs_add_attr(struct fei_attr *attr)
 {
 	struct dentry *dir;
 
 	dir = debugfs_create_dir(attr->kp.symbol_name, fei_debugfs_dir);
-
 	debugfs_create_file("retval", 0600, dir, attr, &fei_retval_ops);
+	debugfs_create_file("parent", 0600, dir, attr, &fei_parent_ops);
 }
 
 static void fei_debugfs_remove_attr(struct fei_attr *attr)
@@ -171,6 +255,16 @@ static void fei_debugfs_remove_attr(struct fei_attr *attr)
 static int fei_kprobe_handler(struct kprobe *kp, struct pt_regs *regs)
 {
 	struct fei_attr *attr = container_of(kp, struct fei_attr, kp);
+	unsigned long ret_addr = 0;
+	bool in_parent = false;
+
+	ret_addr = fei_return_address(regs);
+	if (attr->parent_start) {
+		in_parent = (ret_addr >= attr->parent_start &&
+					ret_addr <  attr->parent_end);
+		if (!in_parent)
+			return 0;
+	}
 
 	if (should_fail(&fei_fault_attr, 1)) {
 		regs_set_return_value(regs, attr->retval);
-- 
2.43.0