From: Brian Foster Date: Thu, 30 Jun 2016 12:49:34 +0000 (-0400) Subject: xfs: test for post umount readahead completion panic X-Git-Tag: v2022.05.01~2459 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=9490edd67755a87152a8f346a6bc9cfdf10ffd26;p=users%2Fhch%2Fxfstests-dev.git xfs: test for post umount readahead completion panic XFS has a bug where directory readahead completions can occur after unmount. This can lead to a crash or panic because metadata read verification attempts to access core XFS data structures (e.g., the log) after they have been freed and certain pointers have been reset. Add a test that triggers directory readahead, delays the readahead I/O and immediately unmounts the filesystem. This test is part of the dangerous group as it will cause kernels affected by the bug to crash. [eguan replaced touch with echo to speedup file creation] Signed-off-by: Brian Foster Reviewed-by: Eryu Guan Signed-off-by: Eryu Guan --- diff --git a/tests/xfs/311 b/tests/xfs/311 new file mode 100755 index 000000000..a2aa3d87d --- /dev/null +++ b/tests/xfs/311 @@ -0,0 +1,91 @@ +#! /bin/bash +# FS QA Test No. 311 +# +# Test to reproduce an XFS unmount crash due to races with directory readahead. +# XFS had a bug in which unmount would proceed with a readahead I/O in flight. +# If the unmount deconstructed the log by the time I/O completion occurs, +# certain metadata read verifier checks could access invalid memory and cause a +# panic. +# +#----------------------------------------------------------------------- +# Copyright (c) 2016 Red Hat, Inc. All Rights Reserved. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it would be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write the Free Software Foundation, +# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA +#----------------------------------------------------------------------- +# + +seq=`basename $0` +seqres=$RESULT_DIR/$seq +echo "QA output created by $seq" + +here=`pwd` +tmp=/tmp/$$ +status=1 # failure is the default! +trap "_cleanup; exit \$status" 0 1 2 3 15 + +_cleanup() +{ + cd / + rm -f $tmp.* + _scratch_unmount > /dev/null 2>&1 + _cleanup_delay > /dev/null 2>&1 +} + +# get standard environment, filters and checks +. ./common/rc +. ./common/dmdelay + +# Modify as appropriate. +_supported_fs xfs +_supported_os Linux + +_require_scratch +_require_dm_target delay + +rm -f $seqres.full + +echo "Silence is golden." + +_scratch_mkfs_xfs >> $seqres.full 2>&1 + +_init_delay +_mount_delay + +# insert entries to grow the directory to at least one extent, which is what +# triggers readahead on dir open +mkdir $SCRATCH_MNT/dir +for i in $(seq 0 999); do + echo > $SCRATCH_MNT/dir/$i +done + +# remount to clear the buffer cache +_unmount_delay +_mount_delay + +# introduce a read I/O delay +_load_delay_table $DELAY_READ + +# Map the directory and immediately unmount. This should invoke an asynchronous +# readahead on the first block of the directory. The readahead is delayed by +# dm-delay. If the unmount doesn't properly wait for the readahead completion, +# the read verifier can run after core data structures have been freed and lead +# to a crash/panic. +$XFS_IO_PROG -c "bmap -v" $SCRATCH_MNT/dir >> $seqres.full 2>&1 +_unmount_delay + +_cleanup_delay + +# success, all done +status=0 +exit diff --git a/tests/xfs/311.out b/tests/xfs/311.out new file mode 100644 index 000000000..542a3f8e5 --- /dev/null +++ b/tests/xfs/311.out @@ -0,0 +1,2 @@ +QA output created by 311 +Silence is golden. diff --git a/tests/xfs/group b/tests/xfs/group index 5a35a764f..0b1b880e7 100644 --- a/tests/xfs/group +++ b/tests/xfs/group @@ -290,3 +290,4 @@ 308 auto quick clone 309 auto clone 310 auto clone rmap +311 auto dangerous quick