Re: [PATCH] xfs: fix incorrect i_nlink caused by inode racing

Long Li
2022-11-10T01:20:36Z

On Mon, Nov 07, 2022 at 08:38:45AM -0800, Darrick J. Wong wrote:
> On Mon, Nov 07, 2022 at 10:36:48PM +0800, Long Li wrote:
> > The following error occurred during the fsstress test:
>
> > XFS: Assertion failed: VFS_I(ip)->i_nlink >= 2, file: fs/xfs/xfs_inode.c, line: 2925
>
> What kernel is this? xfs_inode.c line 2925 is in the middle of
> xfs_rename and doesn't have any assertions on nlink.
>
> The only assertion on nlink in the entire xfs codebase is in xfs_remove,
> and that's not what's going on here.
>
> <confused>

Sorry for the confusion, I found this issue in Linux 5.10, so the assertion
on nlink is in xfs_remove(). I've reproduced it on the mainline kernel, the
probability of this problem is very low and it is very difficult to reproduce.
The mainline kernel assertion error prints is as follows:

XFS: Assertion failed: VFS_I(ip)->i_nlink >= 2, file: fs/xfs/xfs_inode.c, line: 2452

Thanks,
Long Li

>
> --D
>
> > The problem was that inode race condition causes incorrect i_nlink to be
> > written to disk, and then it is read into memory. Consider the following
> > call graph, inodes that are marked as both XFS_IFLUSHING and
> > XFS_IRECLAIMABLE, i_nlink will be reset to 1 and then restored to original
> > value in xfs_reinit_inode(). Therefore, the i_nlink of directory on disk
> > may be set to 1.
> >
> > xfsaild
> > xfs_inode_item_push
> > xfs_iflush_cluster
> > xfs_iflush
> > xfs_inode_to_disk
> >
> > xfs_iget
> > xfs_iget_cache_hit
> > xfs_iget_recycle
> > xfs_reinit_inode
> > inode_init_always
> >
> > So skip inodes that being flushed and markded as XFS_IRECLAIMABLE, prevent
> > concurrent read and write to inodes.
> >
> > Signed-off-by: Long Li <leo.lilong@huawei.com>
> > ---
> > fs/xfs/xfs_icache.c | 5 +++++
> > 1 file changed, 5 insertions(+)
> >
> > diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
> > index eae7427062cf..cc68b0ff50ce 100644
> > --- a/fs/xfs/xfs_icache.c
> > +++ b/fs/xfs/xfs_icache.c
> > @@ -514,6 +514,11 @@ xfs_iget_cache_hit(
> > (ip->i_flags & XFS_IRECLAIMABLE))
> > goto out_skip;
> >
> > + /* Skip inodes that being flushed */
> > + if ((ip->i_flags & XFS_IFLUSHING) &&
> > + (ip->i_flags & XFS_IRECLAIMABLE))
> > + goto out_skip;
> > +
> > /* The inode fits the selection criteria; process it. */
> > if (ip->i_flags & XFS_IRECLAIMABLE) {
> > /* Drops i_flags_lock and RCU read lock. */
> > --
> > 2.31.1
> >