ext4: abort the filesystem if failed to async write metadata buffer

There is a risk of filesystem inconsistency if we failed to async write
back metadata buffer in the background. Because of current buffer's end
io procedure is handled by end_buffer_async_write() in the block layer,
and it only clear the buffer's uptodate flag and mark the write_io_error
flag, so ext4 cannot detect such failure immediately. In most cases of
getting metadata buffer (e.g. ext4_read_inode_bitmap()), although the
buffer's data is actually uptodate, it may still read data from disk
because the buffer's uptodate flag has been cleared. Finally, it may
lead to on-disk filesystem inconsistency if reading old data from the
disk successfully and write them out again.

This patch detect bdev mapping->wb_err when getting journal's write
access and mark the filesystem error if bdev's mapping->wb_err was
increased, this could prevent further writing and potential
inconsistency.

Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Suggested-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200620025427.1756360-2-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 4fba138b8722da21a60fdd8ab6c19eeac18e36d8..26ae31a994a207b46fa46a13e58a4c543d7bee3e 100644 (file)
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1603,6 +1603,9 @@ struct ext4_sb_info {
 #ifdef CONFIG_EXT4_DEBUG
        unsigned long s_simulate_fail;
 #endif
+       /* Record the errseq of the backing block device */
+       errseq_t s_bdev_wb_err;
+       spinlock_t s_bdev_wb_lock;
 };
 
 static inline struct ext4_sb_info *EXT4_SB(struct super_block *sb)

diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index 0c76cdd44d90d02316114172da2ea8bd5120e6a9..760b9ee49dc004dec695a1db564d2acba776ad21 100644 (file)
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -195,6 +195,28 @@ static void ext4_journal_abort_handle(const char *caller, unsigned int line,
        jbd2_journal_abort_handle(handle);
 }
 
+static void ext4_check_bdev_write_error(struct super_block *sb)
+{
+       struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping;
+       struct ext4_sb_info *sbi = EXT4_SB(sb);
+       int err;
+
+       /*
+        * If the block device has write error flag, it may have failed to
+        * async write out metadata buffers in the background. In this case,
+        * we could read old data from disk and write it out again, which
+        * may lead to on-disk filesystem inconsistency.
+        */
+       if (errseq_check(&mapping->wb_err, READ_ONCE(sbi->s_bdev_wb_err))) {
+               spin_lock(&sbi->s_bdev_wb_lock);
+               err = errseq_check_and_advance(&mapping->wb_err, &sbi->s_bdev_wb_err);
+               spin_unlock(&sbi->s_bdev_wb_lock);
+               if (err)
+                       ext4_error_err(sb, -err,
+                                      "Error while async write back metadata");
+       }
+}
+
 int __ext4_journal_get_write_access(const char *where, unsigned int line,
                                    handle_t *handle, struct buffer_head *bh)
 {
@@ -202,6 +224,9 @@ int __ext4_journal_get_write_access(const char *where, unsigned int line,
 
        might_sleep();
 
+       if (bh->b_bdev->bd_super)
+               ext4_check_bdev_write_error(bh->b_bdev->bd_super);
+
        if (ext4_handle_valid(handle)) {
                err = jbd2_journal_get_write_access(handle, bh);
                if (err)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index dda967efcbc2c38220bf364a9bfc6a941dc62cde..c77b10257b36a845f97d851e26c9c473c94c21b5 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4765,6 +4765,15 @@ no_journal:
        }
 #endif  /* CONFIG_QUOTA */
 
+       /*
+        * Save the original bdev mapping's wb_err value which could be
+        * used to detect the metadata async write error.
+        */
+       spin_lock_init(&sbi->s_bdev_wb_lock);
+       if (!sb_rdonly(sb))
+               errseq_check_and_advance(&sb->s_bdev->bd_inode->i_mapping->wb_err,
+                                        &sbi->s_bdev_wb_err);
+       sb->s_bdev->bd_super = sb;
        EXT4_SB(sb)->s_mount_state |= EXT4_ORPHAN_FS;
        ext4_orphan_cleanup(sb, es);
        EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS;
@@ -5654,6 +5663,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
                                goto restore_opts;
                        }
 
+                       /*
+                        * Update the original bdev mapping's wb_err value
+                        * which could be used to detect the metadata async
+                        * write error.
+                        */
+                       errseq_check_and_advance(&sb->s_bdev->bd_inode->i_mapping->wb_err,
+                                                &sbi->s_bdev_wb_err);
+
                        /*
                         * Mounting a RDONLY partition read-write, so reread
                         * and store the current valid flag.  (It may have