Re: [PATCH] btrfs: fix the uninitialized btrfs_bio::iter

[David Sterba <dsterba@suse.cz>]

On Thu, Mar 17, 2022 at 08:23:12AM +0800, Qu Wenruo wrote:
> [BUG]
> There are reports about compression crash with error injection, mostly
> triggering the following ASSERT()s in dec_and_test_compressed_bio():
> 
> 	ASSERT(btrfs_bio(bio)->iter.bi_size);
> 
> The call trace triggered by generic/475 (needs compress mount option)
> looks like this:
> 
>   assertion failed: btrfs_bio(bio)->iter.bi_size, in fs/btrfs/compression.c:213
>   ------------[ cut here ]------------
>   kernel BUG at fs/btrfs/ctree.h:3551!
>   invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
>   CPU: 5 PID: 6548 Comm: fsstress Tainted: G           OE     5.17.0-rc7-custom+ #10
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
>   RIP: 0010:assertfail.constprop.0+0x18/0x1a [btrfs]
>   Call Trace:
>    <TASK>
>    dec_and_test_compressed_bio.cold+0x16/0x2c [btrfs]
>    end_compressed_bio_read+0x37/0x170 [btrfs]
>    btrfs_submit_compressed_read+0x803/0x820 [btrfs]
>    submit_one_bio+0xc7/0x100 [btrfs]
>    btrfs_readpage+0xec/0x130 [btrfs]
>    filemap_read_folio+0x53/0xf0
>    filemap_get_pages+0x6f3/0xa10
>    filemap_read+0x1d6/0x520
>    new_sync_read+0x24e/0x360
>    vfs_read+0x1a1/0x2a0
>    ksys_read+0xc9/0x160
>    do_syscall_64+0x3b/0x90
>    entry_SYSCALL_64_after_hwframe+0x44/0xae
> 
> [CAUSE]
> Unlike regular IO path, we will initialize btrfs_bio::iter in
> btrfs_map_bio(), for error path, we have to manually initialize
> btrfs_bio::iter before calling the endio function.
> 
> In above case, due to injected errors, we go to finish_cb: tag directly
> without submitting with btrfs_map_bio() call.
> 
> This leaves btrfs_bio::iter for the compressed bio uninitialized and
> caught by the ASSERT().
> 
> [FIX]
> Fix it by calling btrfs_bio_save_iter() before we call endio for the
> compressed bio.
> 
> Please fold this fix into commit "btrfs: make
> dec_and_test_compressed_bio() to be split bio compatible".
> 
> If needed, I can update the series and resend, but if this is the only
> problem, it may be better not to flood the list with 17 patches.

No need to resend, fixup folded to the patch and the series will be in
for-next again, thanks.