Write verification was introduced by commit a6bc432e296d ("[JFFS2]
Add support for write-buffer verification.") to detect transport or
program-time corruption. When verification fails, jffs2_wbuf_recover()
attempts to recover the data: it first calls jffs2_block_refile()
to mark the old eraseblock's remaining space as REF_OBSOLETE,
then rewrites the old block's data along with the new data still
in the wbuf to a new block. However, when the recovery write
verification also fails, the function returns without clearing
c->wbuf_len, leaving the wbuf still pointing to the refiled old
block, which leads to two kinds of bugs.
Both cases below are illustrated with a filesystem of
erasesize=16KB and wbuf_pagesize=512B.
Case 1: BUG_ON in jffs2_link_node_ref():
User: Two 1KB writes
ref0: [A+0, A+1092) (ri:68B + data:1024B)
ref1: [A+1092, A+2184)
User: append 1KB write
...
jffs2_write_dnode
jffs2_flash_writev
c->wbuf_ofs = A+2048, c->wbuf_len = 512
__jffs2_flush_wbuf
mtd_write -> 0-to-1 bit flip
jffs2_verify_write -> verify failed
jffs2_wbuf_recover
jffs2_block_refile
c->nextblock = NULL
jffs2_link_node_ref -> mark A remaining
ref2: [A+2184, A+16384) space REF_OBSOLETE,
jeb_A->free_size = 0
jffs2_reserve_space_gc
jffs2_do_reserve_space
jffs2_find_nextblock
c->nextblock = B
start = A+1092, end = A+2184
end - start >= c->wbuf_pagesize -> recover data in A
mtd_write
jffs2_verify_write -> verify also failed
return -> c->wbuf_ofs = A+2048
c->wbuf_len = 512
retry
jffs2_flash_writev
if (SECTOR_ADDR(to) != SECTOR_ADDR(c->wbuf_ofs))
-> SECTOR(to) = B
-> SECTOR(c->wbuf_ofs) = A
__jffs2_flush_wbuf(c, PAD_NOACCOUNT) -> flush residual wbuf data
wbuf_jeb = A -> c->wbuf_ofs still points
to refiled old block
mtd_write -> succeeds via NAND AND
jffs2_verify_write -> passed
if (pad)
jffs2_link_node_ref
ref_offset(ref) = c->wbuf_ofs + c->wbuf_len = A+2560
jeb_A->offset = A
c->sector_size = 16384
jeb_A->free_size = 0
ref_offset(ref) != jeb_A->offset +
c->sector_size - jeb_A->free_size -> BUG
Case 2: deadlock in jffs2_flush_wbuf_pad():
User: 1KB write
A_ref0: [A+0, A+1092) (ri:68B + data:1024B)
User: append 1K write
...
jffs2_write_dnode
jffs2_flash_writev
c->wbuf_ofs = A+1024, c->wbuf_len = 512
__jffs2_flush_wbuf
mtd_write -> bit flip
jffs2_verify_write -> verify failed
jffs2_wbuf_recover
jffs2_block_refile
c->nextblock = NULL
jffs2_link_node_ref -> mark A remaining
A_ref1: [A+1092, A+16384) space as REF_OBSOLETE
jffs2_reserve_space_gc
jffs2_do_reserve_space
jffs2_find_nextblock
c->nextblock = B
start = A, end = A+1092
end - start >= c->wbuf_pagesize -> recover data in A
mtd_write
jffs2_verify_write -> verify also failed
jffs2_add_physical_node_ref -> mark written area in
B_ref0: [B+0, B+1536) B as REF_OBSOLETE
return -> c->wbuf_ofs = A+1024
c->wbuf_len = 512
retry
jffs2_flash_writev
down_write(&c->wbuf_sem)
if (SECTOR_ADDR(to) != SECTOR_ADDR(c->wbuf_ofs))
-> SECTOR(to) = B
-> SECTOR(c->wbuf_ofs) = A
__jffs2_flush_wbuf(c, PAD_NOACCOUNT) -> flush residual wbuf data
wbuf_jeb = A -> c->wbuf_ofs still points
to refiled old block
mtd_write -> bit flip
jffs2_verify_write -> verify failed
jffs2_wbuf_recover
jffs2_block_refile
c->nextblock != jeb -> jeb = A, nextblock = B
jffs2_link_node_ref -> append zero-length ref
A_ref2: [A+16384, A+16384) marked REF_OBSOLETE
after the existing one
end = jeb_A->last_node -> inflates to
eraseblock tail
start = A, end = A+16384
jffs2_reserve_space_gc
minsize = end - start = 16384
jffs2_do_reserve_space
jeb = c->nextblock -> points to B
jeb_B->free_size = 16384 - 1536
minsize > jeb_B->free_size -> first recovery's OBSOLETE
ref reduced free_size
jffs2_wbuf_dirty(c)
jffs2_flush_wbuf_pad(c)
down_write(&c->wbuf_sem) -> already held, deadlock
Fix this by setting c->wbuf_len = 0 when jffs2_verify_write fails in
recovery path, and also in the jffs2_reserve_space_gc() and
jffs2_prealloc_raw_node_refs() failure paths, ensuring subsequent
flushes will not attempt writes on refiled blocks.
Signed-off-by: zhouminqiang <[email protected]>
---
fs/jffs2/wbuf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index 3b7803c75d58..61e3dbd4cd7b 100644
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -390,6 +390,7 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
if (ret) {
pr_warn("Failed to allocate space for wbuf recovery. Data loss
ensues.\n");
kfree(buf);
+ c->wbuf_len = 0;
return;
}
@@ -400,6 +401,7 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
if (ret) {
pr_warn("Failed to allocate node refs for wbuf recovery. Data
loss ensues.\n");
kfree(buf);
+ c->wbuf_len = 0;
return;
}
@@ -431,12 +433,13 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
if (ret || retlen != towrite || jffs2_verify_write(c,
rewrite_buf, ofs)) {
/* Argh. We tried. Really we did. */
- pr_crit("Recovery of wbuf failed due to a second write
error\n");
+ pr_crit("Recovery of wbuf failed due to a second write
error. Data loss ensues.\n");
kfree(buf);
if (retlen)
jffs2_add_physical_node_ref(c, ofs |
REF_OBSOLETE, ref_totlen(c, jeb, first_raw), NULL);
+ c->wbuf_len = 0;
return;
}
pr_notice("Recovery of wbuf succeeded to %08x\n", ofs);
--
2.52.0
