[PATCH v2] jbd2: check superblock mapped prior to committing

[PATCH v2] jbd2: check superblock mapped prior to committing

[Jiufei Xue]

We hit a BUG at fs/buffer.c:3057 if we detached the nbd device
before unmounting ext4 filesystem.

The typical chain of events leading to the BUG:
jbd2_write_superblock
  submit_bh
    submit_bh_wbc
      BUG_ON(!buffer_mapped(bh));

The block device is removed and all the pages are invalidated. JBD2
was trying to write journal superblock to the block device which is
no longer present.

Fix this by checking the journal superblock's buffer head prior to
submitting.

Cc: stable@kernel.org
Reported-by: Eric Ren <renzhen@linux.alibaba.com>
Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
Reviewed-by: Jan Kara <jack@suse.cz>
---
 fs/jbd2/journal.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 382c030cc78b..37e16d969925 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1350,6 +1350,10 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)
 	journal_superblock_t *sb = journal->j_superblock;
 	int ret;
 
+	/* Buffer got discarded which means block device got invalidated */
+	if (!buffer_mapped(bh))
+		return -EIO;
+
 	trace_jbd2_write_superblock(journal, write_flags);
 	if (!(journal->j_flags & JBD2_BARRIER))
 		write_flags &= ~(REQ_FUA | REQ_PREFLUSH);
-- 
2.19.1.856.g8858448bb

Re: [PATCH v2] jbd2: check superblock mapped prior to committing

[Jiufei Xue]

Hi Ted,

can I get your Acked-by?

Thanks,
Jiufei

On 2019/3/28 下午6:07, Jiufei Xue wrote:
> We hit a BUG at fs/buffer.c:3057 if we detached the nbd device
> before unmounting ext4 filesystem.
>
> The typical chain of events leading to the BUG:
> jbd2_write_superblock
>   submit_bh
>     submit_bh_wbc
>       BUG_ON(!buffer_mapped(bh));
>
> The block device is removed and all the pages are invalidated. JBD2
> was trying to write journal superblock to the block device which is
> no longer present.
>
> Fix this by checking the journal superblock's buffer head prior to
> submitting.
>
> Cc: stable@kernel.org
> Reported-by: Eric Ren <renzhen@linux.alibaba.com>
> Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
> Reviewed-by: Jan Kara <jack@suse.cz>
> ---
>  fs/jbd2/journal.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
> index 382c030cc78b..37e16d969925 100644
> --- a/fs/jbd2/journal.c
> +++ b/fs/jbd2/journal.c
> @@ -1350,6 +1350,10 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)
>  	journal_superblock_t *sb = journal->j_superblock;
>  	int ret;
>  
> +	/* Buffer got discarded which means block device got invalidated */
> +	if (!buffer_mapped(bh))
> +		return -EIO;
> +
>  	trace_jbd2_write_superblock(journal, write_flags);
>  	if (!(journal->j_flags & JBD2_BARRIER))
>  		write_flags &= ~(REQ_FUA | REQ_PREFLUSH);

Re: [PATCH v2] jbd2: check superblock mapped prior to committing

[Jan Kara]

Hi,

On Tue 02-04-19 12:11:33, Jiufei Xue wrote:
> can I get your Acked-by?

Ted, tracks patches in patchwork and he processes less important fixes in
bigger batches when he has time. So don't be afraid, your patch is not lost
:)

								Honza

> 
> Thanks,
> Jiufei
> 
> On 2019/3/28 下午6:07, Jiufei Xue wrote:
> > We hit a BUG at fs/buffer.c:3057 if we detached the nbd device
> > before unmounting ext4 filesystem.
> >
> > The typical chain of events leading to the BUG:
> > jbd2_write_superblock
> >   submit_bh
> >     submit_bh_wbc
> >       BUG_ON(!buffer_mapped(bh));
> >
> > The block device is removed and all the pages are invalidated. JBD2
> > was trying to write journal superblock to the block device which is
> > no longer present.
> >
> > Fix this by checking the journal superblock's buffer head prior to
> > submitting.
> >
> > Cc: stable@kernel.org
> > Reported-by: Eric Ren <renzhen@linux.alibaba.com>
> > Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
> > Reviewed-by: Jan Kara <jack@suse.cz>
> > ---
> >  fs/jbd2/journal.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
> > index 382c030cc78b..37e16d969925 100644
> > --- a/fs/jbd2/journal.c
> > +++ b/fs/jbd2/journal.c
> > @@ -1350,6 +1350,10 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)
> >  	journal_superblock_t *sb = journal->j_superblock;
> >  	int ret;
> >  
> > +	/* Buffer got discarded which means block device got invalidated */
> > +	if (!buffer_mapped(bh))
> > +		return -EIO;
> > +
> >  	trace_jbd2_write_superblock(journal, write_flags);
> >  	if (!(journal->j_flags & JBD2_BARRIER))
> >  		write_flags &= ~(REQ_FUA | REQ_PREFLUSH);
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [PATCH v2] jbd2: check superblock mapped prior to committing

[Theodore Ts'o]

On Thu, Mar 28, 2019 at 06:07:50PM +0800, Jiufei Xue wrote:
> We hit a BUG at fs/buffer.c:3057 if we detached the nbd device
> before unmounting ext4 filesystem.
> 
> The typical chain of events leading to the BUG:
> jbd2_write_superblock
>   submit_bh
>     submit_bh_wbc
>       BUG_ON(!buffer_mapped(bh));
> 
> The block device is removed and all the pages are invalidated. JBD2
> was trying to write journal superblock to the block device which is
> no longer present.
> 
> Fix this by checking the journal superblock's buffer head prior to
> submitting.

Thanks, applied.

					- Ted