From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E300C7EE24 for ; Fri, 28 Apr 2023 05:24:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345299AbjD1FYa (ORCPT ); Fri, 28 Apr 2023 01:24:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50846 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345280AbjD1FY3 (ORCPT ); Fri, 28 Apr 2023 01:24:29 -0400 Received: from mail-pl1-x62d.google.com (mail-pl1-x62d.google.com [IPv6:2607:f8b0:4864:20::62d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CCFBF2710 for ; Thu, 27 Apr 2023 22:24:26 -0700 (PDT) Received: by mail-pl1-x62d.google.com with SMTP id d9443c01a7336-1a6c5acf6ccso70403305ad.3 for ; Thu, 27 Apr 2023 22:24:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fromorbit-com.20221208.gappssmtp.com; s=20221208; t=1682659466; x=1685251466; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=5tT+FnXXVAfiL2lANfau8hR1k0QdF35mbhRvcLTl8f8=; b=tyZtkQYqVjHIc1EEnxVQCQG4Tldpi8hGhievTL1QX2Rkc71hGXqhO9HENHkeUSKGnc B61ELQorVwh5O7/rO7z5fQk8mrRW0cvfCtxYqgxvqsi5u0BxK6zAKnGpq5NAkGP/VD/V YcgarWZGxc2icbaGM3rZ5saUPcmMyaRB04AUDhEy+jo1UICcdQ8mgRmIalPW0J3ZEMDF mxLLYpUJsDW/xrgPFLUGzMg3fv13ONzzBYPG4W+dEZXJlh6fYHvFQEaM+tknxaB24AmI xmvwdHeqM776thiHX7JFp2Dxwaf7lEGabm8M7boBdeZJsFFkdhlrl0FkGUSvbHnrZO9G 5nkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682659466; x=1685251466; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=5tT+FnXXVAfiL2lANfau8hR1k0QdF35mbhRvcLTl8f8=; b=ToSwURJ3yWshCG8yN3q5/790i5FvnXdw41RR8wObatNtnvDRTjPAhnfwRe0oqCXCUb HXppjHSydXzhe2WbUCom/cSjcIRFxkiZkuBjAyZvwJl6jXVMcgAVCraaNI2DDYYwmiMa xhJEHvGWqA9J64lDX4Ttq5Oc3W8AIArrKvf1EUxFGAB//7UcIHB8Jpx9BNrYKwFdu02a sZ4kOHJmUzhgEaBOdwVhMqQpkePX0AF6Sz4+2lCWabk9iYuby3LWdb91ipBgcryUqJxq CV2LZYZW1Tiw50WCOBRrxqcOT4HzeuoWFN3/hfVoGJibCRI/SUH1DNlnpLNI0+rnvck2 TfKA== X-Gm-Message-State: AC+VfDyP+cKRFAjeiNsMSL4oBX56pV5r/SLoJPagJcrc6ZAeXA5qQJe+ Ey8NRfhVGLRLBQNrR4BHDj0O7w== X-Google-Smtp-Source: ACHHUZ510rI5TRspLV3WEivPBLF6owNABSCj5GOJiTfryVmfvTBWvFbt5DnvD96jcRuz8RSV72EplQ== X-Received: by 2002:a17:902:fb8f:b0:1a1:defc:30d8 with SMTP id lg15-20020a170902fb8f00b001a1defc30d8mr3489595plb.32.1682659465786; Thu, 27 Apr 2023 22:24:25 -0700 (PDT) Received: from dread.disaster.area (pa49-181-88-204.pa.nsw.optusnet.com.au. [49.181.88.204]) by smtp.gmail.com with ESMTPSA id s13-20020a170902a50d00b001a64ce7b18dsm12476240plq.165.2023.04.27.22.24.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Apr 2023 22:24:25 -0700 (PDT) Received: from dave by dread.disaster.area with local (Exim 4.92.3) (envelope-from ) id 1psGak-008l7h-7i; Fri, 28 Apr 2023 15:24:22 +1000 Date: Fri, 28 Apr 2023 15:24:22 +1000 From: Dave Chinner To: Matthew Wilcox Cc: Dave Chinner , Ming Lei , Theodore Ts'o , linux-ext4@vger.kernel.org, Andreas Dilger , linux-block@vger.kernel.org, Andrew Morton , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, Eric Sandeen , Christoph Hellwig , Zhang Yi Subject: Re: [ext4 io hang] buffered write io hang in balance_dirty_pages Message-ID: <20230428052422.GB1969623@dread.disaster.area> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org On Fri, Apr 28, 2023 at 03:56:13AM +0100, Matthew Wilcox wrote: > On Fri, Apr 28, 2023 at 09:33:20AM +1000, Dave Chinner wrote: > > The block device needs to be shutting down the filesystem when it > > has some sort of fatal, unrecoverable error like this (e.g. hot > > unplug). We have the XFS_IOC_GOINGDOWN ioctl for telling the > > filesystem it can't function anymore. This ioctl > > (_IOR('X',125,__u32)) has also been replicated into ext4, f2fs and > > CIFS and it gets exercised heavily by fstests. Hence this isn't XFS > > specific functionality, nor is it untested functionality. > > > > The ioctl should be lifted to the VFS as FS_IOC_SHUTDOWN and a > > super_operations method added to trigger a filesystem shutdown. > > That way the block device removal code could simply call > > sb->s_ops->shutdown(sb, REASON) if it exists rather than > > sync_filesystem(sb) if there's a superblock associated with the > > block device. Then all these > > I think this is the wrong approach. Not that I've had any time to > work on my alternative approach: > > https://www.infradead.org/~willy/banbury.html While that looks interesting, I'm going to say straight out that re-attaching a storage device that was hot-unplugged from under a running filesystem and then resuming service as if nothing happened is going to be both a filesystem corruption vector and a major security hole. The moment a mounted device is unexpectedly unplugged, it becomes an untrusted device. We cannot trust that it's contents when plugged back in are identical to when it was unplugged. I can't wait for syzbot to learn that it can mount a filesystem, hot-unplug the device, fuzz the image on the device and then plug it back in and expect the filesystem to handle the in-memory vs on-disk inconsistencies that result from the fuzzing. it's basically no different to allowing someone to write to the block device while the filesystem is mounted. You do that, you get to keep all the broken bits to yourself. Even without image tampering considerations, there's no guarantee that the device caches are flushed properly when someone just pulls the plug on a storage device. Hence even without tampering, we cannot trust the image on the device to match what the in-memory state of the filesystem expects it to be. So, yeah, I just don't see this ever being something we'd support with filesystems like XFS - there's just too much risk associated with untrusted devices... -Dave. -- Dave Chinner david@fromorbit.com