From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9535E1AF0CA; Thu, 30 Jan 2025 08:41:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738226485; cv=none; b=uoqkbu7ccPAPd2gDhhPbxynMhwU7MmLEd5V873stqunv942KOXG3BJHU+HOAJl71/Zlb1z26280ZzhjjbLfGfuDgD3G1na/mpWrgzrKDRgPp4AhLLzCZngpb5pv+ZjmAi16c+0RLaqWca46VqLVT9jno5uVz2VFRgHhMd9siSIk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738226485; c=relaxed/simple; bh=Mo7sVeSRainMxWPxhebOzIUMQASOgzC+BnQAkcdqEi8=; h=Subject:To:Cc:From:Date:In-Reply-To:Message-ID:MIME-Version: Content-Type; b=LkuD4+hIVEDTPfFLwlR5IOsXRvMcSA2/bbYVSMC+p2Os6QnM6Lb6uFW8KaXJtZfK9JF4E+xFgbHg/tQjp+oW2p2pLj/3QgyT5hArfHJjugVHRjy/wqPtqE6kniASS3+WDBYqsoljSHacgxAv5Qa685E+5CO9OUINRlaJdgWb5OE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lWyPt1Q8; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="lWyPt1Q8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1BBF2C4CEE0; Thu, 30 Jan 2025 08:41:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1738226485; bh=Mo7sVeSRainMxWPxhebOzIUMQASOgzC+BnQAkcdqEi8=; h=Subject:To:Cc:From:Date:In-Reply-To:From; b=lWyPt1Q8U8lAKRdNQM02eruV8ms3ma78k/cDRQWrFbwZRc7hWLdHyTGZiFQUyuVX2 Mmcf0kJO8ZK5MYaBORUCD0pRBBn5mISziEMIoCVCsGSrO7sA1iiGfSMnvnSE6rJf3l SCUt5Q3Cu0RGmFxzKtpsJtw/UB897lMzXatfsVu4= Subject: Patch "xfs: fix internal error from AGFL exhaustion" has been added to the 6.1-stable tree To: amir73il@gmail.com,catherine.hoang@oracle.com,chandan.babu@oracle.com,chandanbabu@kernel.org,dchinner@redhat.com,djwong@kernel.org,gregkh@linuxfoundation.org,leah.rumancik@gmail.com,osandov@fb.com,xfs-stable@lists.linux.dev Cc: From: Date: Thu, 30 Jan 2025 09:40:59 +0100 In-Reply-To: <20250129184717.80816-15-leah.rumancik@gmail.com> Message-ID: <2025013059-approval-crumpled-d672@gregkh> Precedence: bulk X-Mailing-List: xfs-stable@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit X-stable: commit X-Patchwork-Hint: ignore This is a note to let you know that I've just added the patch titled xfs: fix internal error from AGFL exhaustion to the 6.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xfs-fix-internal-error-from-agfl-exhaustion.patch and it can be found in the queue-6.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >From stable+bounces-111225-greg=kroah.com@vger.kernel.org Wed Jan 29 19:47:57 2025 From: Leah Rumancik Date: Wed, 29 Jan 2025 10:47:12 -0800 Subject: xfs: fix internal error from AGFL exhaustion To: stable@vger.kernel.org Cc: xfs-stable@lists.linux.dev, amir73il@gmail.com, chandan.babu@oracle.com, catherine.hoang@oracle.com, Omar Sandoval , "Darrick J. Wong" , Dave Chinner , Chandan Babu R , Leah Rumancik Message-ID: <20250129184717.80816-15-leah.rumancik@gmail.com> From: Omar Sandoval [ Upstream commit f63a5b3769ad7659da4c0420751d78958ab97675 ] We've been seeing XFS errors like the following: XFS: Internal error i != 1 at line 3526 of file fs/xfs/libxfs/xfs_btree.c. Caller xfs_btree_insert+0x1ec/0x280 ... Call Trace: xfs_corruption_error+0x94/0xa0 xfs_btree_insert+0x221/0x280 xfs_alloc_fixup_trees+0x104/0x3e0 xfs_alloc_ag_vextent_size+0x667/0x820 xfs_alloc_fix_freelist+0x5d9/0x750 xfs_free_extent_fix_freelist+0x65/0xa0 __xfs_free_extent+0x57/0x180 ... This is the XFS_IS_CORRUPT() check in xfs_btree_insert() when xfs_btree_insrec() fails. After converting this into a panic and dissecting the core dump, I found that xfs_btree_insrec() is failing because it's trying to split a leaf node in the cntbt when the AG free list is empty. In particular, it's failing to get a block from the AGFL _while trying to refill the AGFL_. If a single operation splits every level of the bnobt and the cntbt (and the rmapbt if it is enabled) at once, the free list will be empty. Then, when the next operation tries to refill the free list, it allocates space. If the allocation does not use a full extent, it will need to insert records for the remaining space in the bnobt and cntbt. And if those new records go in full leaves, the leaves (and potentially more nodes up to the old root) need to be split. Fix it by accounting for the additional splits that may be required to refill the free list in the calculation for the minimum free list size. P.S. As far as I can tell, this bug has existed for a long time -- maybe back to xfs-history commit afdf80ae7405 ("Add XFS_AG_MAXLEVELS macros ...") in April 1994! It requires a very unlucky sequence of events, and in fact we didn't hit it until a particular sparse mmap workload updated from 5.12 to 5.19. But this bug existed in 5.12, so it must've been exposed by some other change in allocation or writeback patterns. It's also much less likely to be hit with the rmapbt enabled, since that increases the minimum free list size and is unlikely to split at the same time as the bnobt and cntbt. Reviewed-by: "Darrick J. Wong" Reviewed-by: Dave Chinner Signed-off-by: Omar Sandoval Signed-off-by: Chandan Babu R Signed-off-by: Leah Rumancik Signed-off-by: Greg Kroah-Hartman --- fs/xfs/libxfs/xfs_alloc.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) --- a/fs/xfs/libxfs/xfs_alloc.c +++ b/fs/xfs/libxfs/xfs_alloc.c @@ -2273,16 +2273,37 @@ xfs_alloc_min_freelist( ASSERT(mp->m_alloc_maxlevels > 0); + /* + * For a btree shorter than the maximum height, the worst case is that + * every level gets split and a new level is added, then while inserting + * another entry to refill the AGFL, every level under the old root gets + * split again. This is: + * + * (full height split reservation) + (AGFL refill split height) + * = (current height + 1) + (current height - 1) + * = (new height) + (new height - 2) + * = 2 * new height - 2 + * + * For a btree of maximum height, the worst case is that every level + * under the root gets split, then while inserting another entry to + * refill the AGFL, every level under the root gets split again. This is + * also: + * + * 2 * (current height - 1) + * = 2 * (new height - 1) + * = 2 * new height - 2 + */ + /* space needed by-bno freespace btree */ min_free = min_t(unsigned int, levels[XFS_BTNUM_BNOi] + 1, - mp->m_alloc_maxlevels); + mp->m_alloc_maxlevels) * 2 - 2; /* space needed by-size freespace btree */ min_free += min_t(unsigned int, levels[XFS_BTNUM_CNTi] + 1, - mp->m_alloc_maxlevels); + mp->m_alloc_maxlevels) * 2 - 2; /* space needed reverse mapping used space btree */ if (xfs_has_rmapbt(mp)) min_free += min_t(unsigned int, levels[XFS_BTNUM_RMAPi] + 1, - mp->m_rmap_maxlevels); + mp->m_rmap_maxlevels) * 2 - 2; return min_free; } Patches currently in stable-queue which might be from leah.rumancik@gmail.com are queue-6.1/xfs-allow-read-io-and-ficlone-to-run-concurrently.patch queue-6.1/xfs-hoist-freeing-of-rt-data-fork-extent-mappings.patch queue-6.1/xfs-make-sure-maxlen-is-still-congruent-with-prod-when-rounding-down.patch queue-6.1/xfs-only-remap-the-written-blocks-in-xfs_reflink_end_cow_extent.patch queue-6.1/xfs-dquot-recovery-does-not-validate-the-recovered-dquot.patch queue-6.1/xfs-clean-up-dqblk-extraction.patch queue-6.1/xfs-abort-intent-items-when-recovery-intents-fail.patch queue-6.1/xfs-up-ic_sema-if-flushing-data-device-fails.patch queue-6.1/xfs-fix-internal-error-from-agfl-exhaustion.patch queue-6.1/xfs-factor-out-xfs_defer_pending_abort.patch queue-6.1/xfs-fix-units-conversion-error-in-xfs_bmap_del_extent_delay.patch queue-6.1/xfs-bump-max-fsgeom-struct-version.patch queue-6.1/xfs-handle-nimaps-0-from-xfs_bmapi_write-in-xfs_alloc_file_space.patch queue-6.1/xfs-rt-stubs-should-return-negative-errnos-when-rt-disabled.patch queue-6.1/xfs-clean-up-fs_xflag_realtime-handling-in-xfs_ioctl_setattr_xflags.patch queue-6.1/xfs-respect-the-stable-writes-flag-on-the-rt-device.patch queue-6.1/xfs-introduce-protection-for-drop-nlink.patch queue-6.1/xfs-prevent-rt-growfs-when-quota-is-enabled.patch queue-6.1/xfs-inode-recovery-does-not-validate-the-recovered-inode.patch