[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-04-13 Thread Ubuntu Kernel Bot
This bug is awaiting verification that the linux-xilinx-
zynqmp/5.4.0-1023.27 kernel in -proposed solves the problem. Please test
the kernel and update this bug with the results. If the problem is
solved, change the tag 'verification-needed-focal' to 'verification-
done-focal'. If the problem still exists, change the tag 'verification-
needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will
be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how
to enable and use -proposed. Thank you!


** Tags added: kernel-spammed-focal-linux-xilinx-zynqmp

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Released
Status in linux source package in Focal:
  Fix Released

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
  $ cd xfstests-dev
  $ make
  $ sudo su
  # 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-04-12 Thread Roxana Nicolescu
bionic:linux-snapdragon was not released last cycle, hence it asks for 
verification again. 
Given that the main kernel was verified, I will mark this as verified as well. 

** Tags removed: verification-needed-bionic
** Tags added: verification-done-bionic

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Released
Status in linux source package in Focal:
  Fix Released

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
  $ cd xfstests-dev
  $ make
  $ sudo su
  # mkdir /test
  # mkdir /scratch
  # mkfs.btrfs -f /dev/vdc
  # cat << EOF >> ./local.config
  export TEST_DEV=/dev/vdc
  export TEST_DIR=/test
  export SCRATCH_DEV=/dev/vdd
  export SCRATCH_MNT=/scratch
  EOF

  # ./check btrfs/154

  btrfs/154   _check_dmesg: something found in dmesg (see 
/home/ubuntu/xfstests-dev/results//btrfs/154.dmesg)
  - output mismatch (see /home/ubuntu/xfstests-dev/results//btrfs/154.out.bad)
  

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-04-10 Thread Ubuntu Kernel Bot
This bug is awaiting verification that the linux-
snapdragon/4.15.0-1148.158 kernel in -proposed solves the problem.
Please test the kernel and update this bug with the results. If the
problem is solved, change the tag 'verification-needed-bionic' to
'verification-done-bionic'. If the problem still exists, change the tag
'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will
be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how
to enable and use -proposed. Thank you!


** Tags removed: verification-done-bionic
** Tags added: kernel-spammed-bionic-linux-snapdragon verification-needed-bionic

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Released
Status in linux source package in Focal:
  Fix Released

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-04-05 Thread Ubuntu Kernel Bot
This bug is awaiting verification that the linux-bluefield/5.4.0-1060.66
kernel in -proposed solves the problem. Please test the kernel and
update this bug with the results. If the problem is solved, change the
tag 'verification-needed-focal' to 'verification-done-focal'. If the
problem still exists, change the tag 'verification-needed-focal' to
'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will
be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how
to enable and use -proposed. Thank you!


** Tags added: kernel-spammed-focal-linux-bluefield

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Released
Status in linux source package in Focal:
  Fix Released

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
  $ cd xfstests-dev
  $ make
  $ sudo su
  # mkdir 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-03-30 Thread Ubuntu Kernel Bot
This bug is awaiting verification that the linux-azure/5.4.0-1106.112
kernel in -proposed solves the problem. Please test the kernel and
update this bug with the results. If the problem is solved, change the
tag 'verification-needed-focal' to 'verification-done-focal'. If the
problem still exists, change the tag 'verification-needed-focal' to
'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will
be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how
to enable and use -proposed. Thank you!


** Tags added: kernel-spammed-focal-linux-azure

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Released
Status in linux source package in Focal:
  Fix Released

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
  $ cd xfstests-dev
  $ make
  $ sudo su
  # mkdir /test
  # 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-03-30 Thread Ubuntu Kernel Bot
This bug is awaiting verification that the linux-aws/5.4.0-1100.108
kernel in -proposed solves the problem. Please test the kernel and
update this bug with the results. If the problem is solved, change the
tag 'verification-needed-focal' to 'verification-done-focal'. If the
problem still exists, change the tag 'verification-needed-focal' to
'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will
be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how
to enable and use -proposed. Thank you!


** Tags removed: verification-done-focal
** Tags added: kernel-spammed-focal-linux-aws verification-needed-focal

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Released
Status in linux source package in Focal:
  Fix Released

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-03-27 Thread Launchpad Bug Tracker
This bug was fixed in the package linux - 4.15.0-208.220

---
linux (4.15.0-208.220) bionic; urgency=medium

  * bionic/linux: 4.15.0-208.220 -proposed tracker (LP: #2012097)

  * NFS deathlock with last Kernel 5.4.0-144.161 and 5.15.0-67.74 (LP: #2009325)
- NFS: Correct timing for assigning access cache timestamp

linux (4.15.0-207.218) bionic; urgency=medium

  * bionic/linux: 4.15.0-207.218 -proposed tracker (LP: #2008419)

  * rtcpie in timers from ubuntu_kernel_selftests randomly failing
(LP: #1814234)
- SAUCE: selftest: rtctest: Force passing unreliable subtest

  * btrfs/154: rename fails with EOVERFLOW when calculating item size during
item key collision (LP: #2004132)
- btrfs: correctly calculate item size used when item key collision happens

  * CVE-2021-3669
- ipc: replace costly bailout check in sysvipc_find_ipc()

  * Bionic update: upstream stable patchset 2023-02-06 (LP: #2006403)
- libtraceevent: Fix build with binutils 2.35
- once: Fix panic when module unload
- once: add DO_ONCE_SLOW() for sleepable contexts
- mm/khugepaged: fix GUP-fast interaction by sending IPI
- mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
- block: unhash blkdev part inode when the part is deleted
- ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
- can: sja1000: fix size of OCR_MODE_MASK define
- can: mcba_usb: Fix termination command argument
- ASoC: ops: Correct bounds check for second channel on SX controls
- perf script python: Remove explicit shebang from tests/attr.c
- udf: Discard preallocation before extending file with a hole
- udf: Drop unused arguments of udf_delete_aext()
- udf: Fix preallocation discarding at indirect extent boundary
- udf: Do not bother looking for prealloc extents if i_lenExtents matches
  i_size
- udf: Fix extending file within last block
- usb: gadget: uvc: Prevent buffer overflow in setup handler
- USB: serial: option: add Quectel EM05-G modem
- USB: serial: cp210x: add Kamstrup RF sniffer PIDs
- igb: Initialize mailbox message for VF reset
- net: loopback: use NET_NAME_PREDICTABLE for name_assign_type
- usb: musb: remove extra check in musb_gadget_vbus_draw
- ARM: dts: qcom: apq8064: fix coresight compatible
- drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
- arm: dts: spear600: Fix clcd interrupt
- soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
- arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name
- ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
- ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
- ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
- ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
- ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
- ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
- ARM: dts: turris-omnia: Add ethernet aliases
- ARM: dts: turris-omnia: Add switch port 6 node
- pstore/ram: Fix error return code in ramoops_probe()
- ARM: mmp: fix timer_read delay
- pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
- tpm/tpm_crb: Fix error message in __crb_relinquish_locality()
- cpuidle: dt: Return the correct numbers of parsed idle states
- alpha: fix syscall entry in !AUDUT_SYSCALL case
- PM: hibernate: Fix mistake in kerneldoc comment
- fs: don't audit the capability check in simple_xattr_list()
- perf: Fix possible memleak in pmu_dev_alloc()
- timerqueue: Use rb_entry_safe() in timerqueue_getnext()
- ocfs2: fix memory leak in ocfs2_stack_glue_init()
- MIPS: vpe-mt: fix possible memory leak while module exiting
- MIPS: vpe-cmp: fix possible memory leak while module exiting
- PNP: fix name memory leak in pnp_alloc_dev()
- irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
- libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
- lib/notifier-error-inject: fix error when writing -errno to debugfs file
- rapidio: fix possible name leaks when rio_add_device() fails
- rapidio: rio: fix possible name leak in rio_register_mport()
- ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
- uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
- x86/xen: Fix memory leak in xen_init_lock_cpu()
- platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
- MIPS: BCM63xx: Add check for NULL for clk in clk_enable
- fs: sysv: Fix sysv_nblocks() returns wrong value
- rapidio: fix possible UAF when kfifo_alloc() fails
- eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
- hfs: Fix OOB Write in hfs_asc2mac
- rapidio: devices: fix missing put_device in mport_cdev_open
- wifi: ath9k: hif_usb: fix memory leak of urbs 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-03-27 Thread Launchpad Bug Tracker
This bug was fixed in the package linux - 5.4.0-146.163

---
linux (5.4.0-146.163) focal; urgency=medium

  * focal/linux: 5.4.0-146.163 -proposed tracker (LP: #2012094)

  * NFS deathlock with last Kernel 5.4.0-144.161 and 5.15.0-67.74 (LP: #2009325)
- NFS: Correct timing for assigning access cache timestamp

linux (5.4.0-145.162) focal; urgency=medium

  * focal/linux: 5.4.0-145.162 -proposed tracker (LP: #2008389)

  * [SRU]Update ice driver to support E823 devices (LP: #1986717)
- ice: Add device ids for E822 devices
- ice: add support for E823 devices

  * btrfs/154: rename fails with EOVERFLOW when calculating item size during
item key collision (LP: #2004132)
- btrfs: correctly calculate item size used when item key collision happens

  * rtcpie in timers from ubuntu_kernel_selftests randomly failing
(LP: #1814234)
- SAUCE: selftest: rtcpie: Force passing unreliable subtest

  * [UBUNTU 20.04] KVM: s390: pv: don't allow userspace to set the clock under
PV - kernel part (LP: #1999882)
- KVM: s390x: fix SCK locking
- KVM: s390: pv: don't allow userspace to set the clock under PV

  * CVE-2021-3669
- ipc: replace costly bailout check in sysvipc_find_ipc()

  * net:fcnal-test.sh 'nettest' command not found on F/K (LP: #2006391)
- selftests/net: Find nettest in current directory

  * xfs: Preallocated ioend transactions cause deadlock due to log buffer
exhaustion (LP: #2007219)
- xfs: drop submit side trans alloc for append ioends

  * CVE-2022-4382
- USB: gadgetfs: Fix race between mounting and unmounting

  * CVE-2022-2196
- KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS

  * ubuntu_kernel_selftests: net:udpgso_bench.sh failed (LP: #1951447)
- selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs

  * net:fcnal-test.sh didn't return a non-zero value even with some sub-tests
failed (LP: #2006692)
- selftests: net/fcnal-test.sh: add exit code

  * Fix selftests/ftracetests/Meta-selftests in Focal (LP: #2006453)
- SAUCE: Fix ftrace/Meta-selftests bashism check

  * CVE-2023-23559
- wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid

 -- Luke Nowakowski-Krijger   Fri,
17 Mar 2023 11:08:20 -0700

** Changed in: linux (Ubuntu Focal)
   Status: Fix Committed => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3669

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-2196

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-4382

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-23559

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Committed
Status in linux source package in Focal:
  Fix Released

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-03-13 Thread Matthew Ruffell
Performing verification for Bionic

I started a fresh VM with 4.15.0-206-generic from -updates. I attached 2x virtio
disks of 3gb each, for scratch disks.

I ran btrfs/154 with the following results:

# ./check btrfs/154
FSTYP -- btrfs
PLATFORM  -- Linux/x86_64 bionic-xfs 4.15.0-206-generic #217-Ubuntu SMP Fri 
Feb 3 19:10:13 UTC 2023
MKFS_OPTIONS  -- /dev/vdd
MOUNT_OPTIONS -- /dev/vdd /scratch

btrfs/154 4s ... _check_dmesg: something found in dmesg (see 
/home/ubuntu/xfstests-dev/results//btrfs/154.dmesg)
- output mismatch (see /home/ubuntu/xfstests-dev/results//btrfs/154.out.bad)
--- tests/btrfs/154.out 2023-01-28 02:53:03.566450703 +
+++ /home/ubuntu/xfstests-dev/results//btrfs/154.out.bad2023-03-14 
04:46:12.824848412 +
@@ -1,2 +1,6 @@
 QA output created by 154
+Traceback (most recent call last):
+  File "/home/ubuntu/xfstests-dev/src/btrfs_crc32c_forged_name.py", line 
99, in 
+os.rename(srcpath, dstpath)
+OSError: [Errno 75] Value too large for defined data type: '/scratch/309' 
-> 
b'/scratch/ec73\xb4\xd3?\xc4249e4acad9bcfc483738ce72c1da9a5e0dcc098e3103a2e00d8e05fe6a463df2c472d5df948dc08e6aaf48cdff3c41de690ce50cd88be6cdea40e616db44152df10f8dfe36a5de62550b277db85c01455dde98b189b68'
 Silence is golden
...
(Run 'diff -u /home/ubuntu/xfstests-dev/tests/btrfs/154.out 
/home/ubuntu/xfstests-dev/results//btrfs/154.out.bad'  to see the entire diff)
Ran: btrfs/154
Failures: btrfs/154
Failed 1 of 1 tests

[   69.108117] BTRFS: device fsid 032cd7d2-e729-4a6a-aa6d-95141191525a devid 1 
transid 5 /dev/vdc
[   78.693183] BTRFS info (device vdc): disk space caching is enabled
[   78.693184] BTRFS info (device vdc): has skinny extents
[   78.693185] BTRFS info (device vdc): flagging fs with big metadata feature
[   78.695928] BTRFS info (device vdc): creating UUID tree
[   78.828837] BTRFS: device fsid 053e2dfb-59fb-45ab-8a69-08262d44d669 devid 1 
transid 5 /dev/vdd
[   78.840701] BTRFS info (device vdd): disk space caching is enabled
[   78.840703] BTRFS info (device vdd): has skinny extents
[   78.840704] BTRFS info (device vdd): flagging fs with big metadata feature
[   78.843953] BTRFS info (device vdd): creating UUID tree
[   79.053524] BTRFS info (device vdc): disk space caching is enabled
[   79.053526] BTRFS info (device vdc): has skinny extents
[   79.104532] run fstests btrfs/154 at 2023-03-14 04:46:08
[   79.230124] BTRFS: device fsid af57acbb-7a45-46e8-969f-4cb3ce52e29e devid 1 
transid 5 /dev/vdd
[   79.235760] BTRFS info (device vdd): disk space caching is enabled
[   79.235761] BTRFS info (device vdd): has skinny extents
[   79.235761] BTRFS info (device vdd): flagging fs with big metadata feature
[   79.239893] BTRFS info (device vdd): creating UUID tree
[   82.714095] [ cut here ]
[   82.714098] BTRFS: Transaction aborted (error -75)
[   82.714180] WARNING: CPU: 2 PID: 1883 at 
/build/linux-sIqTXt/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
[   82.714210] CPU: 2 PID: 1883 Comm: python3 Not tainted 4.15.0-206-generic 
#217-Ubuntu
[   82.714212] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 
1.16.0-debian-1.16.0-4 04/01/2014
[   82.714234] RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
[   82.714235] RSP: 0018:af86c1adfd20 EFLAGS: 00010282
[   82.714238] RAX:  RBX: 96e6f7bac118 RCX: 0006
[   82.714239] RDX: 0007 RSI: 0096 RDI: 96e6ffd1b4d0
[   82.714240] RBP: af86c1adfdc0 R08: 02d9 R09: 0004
[   82.714241] R10:  R11: 0001 R12: 0236
[   82.714242] R13: 96e6f6842618 R14: 96e6f7b78cc0 R15: 96e6f7bac118
[   82.714245] FS:  7fbf05988740() GS:96e6ffd0() 
knlGS:
[   82.714246] CS:  0010 DS:  ES:  CR0: 80050033
[   82.714248] CR2: 7fbf058ef4c8 CR3: 000175166005 CR4: 00760ee0
[   82.714254] PKRU: 5554
[   82.714255] Call Trace:
[   82.714277]  btrfs_rename2+0x1d/0x30 [btrfs]
[   82.714283]  vfs_rename+0x46e/0x960
[   82.714287]  SyS_rename+0x362/0x3c0
[   82.714293]  do_syscall_64+0x73/0x130
[   82.714297]  entry_SYSCALL_64_after_hwframe+0x59/0xbe
[   82.714299] RIP: 0033:0x7fbf053f8ce7
[   82.714300] RSP: 002b:7ffdb2ba86d8 EFLAGS: 0246 ORIG_RAX: 
0052
[   82.714302] RAX: ffda RBX: 7ffdb2ba8790 RCX: 7fbf053f8ce7
[   82.714303] RDX:  RSI: 7fbf044872f0 RDI: 7fbf057dafb0
[   82.714304] RBP: ff00 R08:  R09: 00713557
[   82.714306] R10:  R11: 0246 R12: 7ffdb2ba8740
[   82.714307] R13: ff9c R14: ff9c R15: 01365da0
[   82.714309] Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 
00 44 89 c6 48 c7 c7 68 83 43 c0 44 89 55 80 44 89 45 98 e8 6f 1c 0e f5 <0f> 0b 
44 8b 45 98 44 8b 55 80 44 89 55 80 44 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-03-13 Thread Matthew Ruffell
Performing verification for Focal

I started a fresh VM with 5.4.0-144-generic from -updates. I attached 2x virtio
disks of 3gb each, for scratch disks.

I ran btrfs/154 with the following results:

# ./check btrfs/154
FSTYP -- btrfs
PLATFORM  -- Linux/x86_64 focal-xfs 5.4.0-144-generic #161-Ubuntu SMP Fri 
Feb 3 14:49:04 UTC 2023
MKFS_OPTIONS  -- /dev/vdd
MOUNT_OPTIONS -- /dev/vdd /scratch

btrfs/154 4s ... _check_dmesg: something found in dmesg (see 
/home/ubuntu/xfstests-dev/results//btrfs/154.dmesg)
- output mismatch (see /home/ubuntu/xfstests-dev/results//btrfs/154.out.bad)
--- tests/btrfs/154.out 2023-01-28 07:54:34.007433164 +
+++ /home/ubuntu/xfstests-dev/results//btrfs/154.out.bad2023-03-14 
04:34:53.765899711 +
@@ -1,2 +1,6 @@
 QA output created by 154
+Traceback (most recent call last):
+  File "/home/ubuntu/xfstests-dev/src/btrfs_crc32c_forged_name.py", line 
99, in 
+os.rename(srcpath, dstpath)
+OSError: [Errno 75] Value too large for defined data type: '/scratch/309' 
-> 
b'/scratch/69f3?u\x97\xf3c33c58c648a2a9686fad82dbf43d7bfb443de4698f629e5b2b95126d6382430b8f29e4f502ccf306254d24cfd3800cb04a305989253db49f699a83cc2bc5d86a4f9b235891c0f72ba344a34e41aa69f819f196f7dbf29'
 Silence is golden
...
(Run 'diff -u /home/ubuntu/xfstests-dev/tests/btrfs/154.out 
/home/ubuntu/xfstests-dev/results//btrfs/154.out.bad'  to see the entire diff)
Ran: btrfs/154
Failures: btrfs/154
Failed 1 of 1 tests

[   49.889518] BTRFS info (device vdc): flagging fs with big metadata feature
[   49.889520] BTRFS info (device vdc): disk space caching is enabled
[   49.889521] BTRFS info (device vdc): has skinny extents
[   49.891250] BTRFS info (device vdc): checking UUID tree
[   50.007425] BTRFS: device fsid 382d436d-5f41-48a3-b96d-42c07ede9a03 devid 1 
transid 5 /dev/vdd
[   50.012807] BTRFS info (device vdd): flagging fs with big metadata feature
[   50.012809] BTRFS info (device vdd): disk space caching is enabled
[   50.012810] BTRFS info (device vdd): has skinny extents
[   50.014307] BTRFS info (device vdd): checking UUID tree
[   50.171099] BTRFS info (device vdc): flagging fs with big metadata feature
[   50.171102] BTRFS info (device vdc): disk space caching is enabled
[   50.171103] BTRFS info (device vdc): has skinny extents
[   50.204928] run fstests btrfs/154 at 2023-03-14 04:34:47
[   50.378091] BTRFS: device fsid 68eee97a-92e0-47da-9d5e-c6c8312ee358 devid 1 
transid 5 /dev/vdd
[   50.393188] BTRFS info (device vdd): flagging fs with big metadata feature
[   50.393191] BTRFS info (device vdd): disk space caching is enabled
[   50.393193] BTRFS info (device vdd): has skinny extents
[   50.401657] BTRFS info (device vdd): checking UUID tree
[   56.084117] [ cut here ]
[   56.084121] BTRFS: Transaction aborted (error -75)
[   56.084229] WARNING: CPU: 2 PID: 1741 at fs/btrfs/inode.c:10148 
btrfs_rename+0x9c6/0xa40 [btrfs]
[   56.084265] CPU: 2 PID: 1741 Comm: python3 Not tainted 5.4.0-144-generic 
#161-Ubuntu
[   56.084267] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 
1.16.0-debian-1.16.0-4 04/01/2014
[   56.084302] RIP: 0010:btrfs_rename+0x9c6/0xa40 [btrfs]
[   56.084306] Code: 48 0f ba a8 38 ce 00 00 02 72 25 41 83 f8 fb 74 43 41 83 
f8 e2 74 3d 44 89 c6 48 c7 c7 e0 68 49 c0 44 89 45 a0 e8 ac 2c 0a e6 <0f> 0b 44 
8b 45 a0 44 89 c1 ba a4 27 00 00 4c 89 f7 44 89 45 a0 48
[   56.084309] RSP: 0018:bb1182f17cd8 EFLAGS: 00010286
[   56.084311] RAX:  RBX: 9ca8b7114210 RCX: 0006
[   56.084313] RDX: 0007 RSI: 0086 RDI: 9ca8bbb1c8c0
[   56.084314] RBP: bb1182f17d70 R08: 032b R09: 0004
[   56.084315] R10:  R11: 0001 R12: 9ca8b7104b40
[   56.084317] R13: 9ca8b726a220 R14: 9ca8b7b03548 R15: 0236
[   56.084320] FS:  7f3e9e8be740() GS:9ca8bbb0() 
knlGS:
[   56.084321] CS:  0010 DS:  ES:  CR0: 80050033
[   56.084323] CR2: 7fb85fbc5110 CR3: 00016c17e004 CR4: 00760ee0
[   56.084331] PKRU: 5554
[   56.084333] Call Trace:
[   56.084364]  btrfs_rename2+0x1d/0x30 [btrfs]
[   56.084371]  vfs_rename+0x3df/0x9b0
[   56.084377]  ? _cond_resched+0x19/0x30
[   56.084383]  ? security_path_rename+0x88/0xb0
[   56.084387]  do_renameat2+0x507/0x570
[   56.084391]  __x64_sys_rename+0x23/0x30
[   56.084397]  do_syscall_64+0x57/0x190
[   56.084401]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[   56.084403] RIP: 0033:0x7f3e9eaece8b
[   56.084406] Code: e8 ca ce 0a 00 85 c0 0f 95 c0 0f b6 c0 f7 d8 5d c3 66 0f 
1f 44 00 00 b8 ff ff ff ff 5d c3 90 f3 0f 1e fa b8 52 00 00 00 0f 05 <48> 3d 00 
f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 d1 8f 18 00 f7 d8
[   56.084408] RSP: 002b:7ffddfe043f8 EFLAGS: 0246 ORIG_RAX: 
0052
[   56.084410] RAX: ffda RBX: 7ffddfe044c0 RCX: 7f3e9eaece8b
[   56.084412] 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-03-02 Thread Ubuntu Kernel Bot
This bug is awaiting verification that the linux/4.15.0-207.218 kernel
in -proposed solves the problem. Please test the kernel and update this
bug with the results. If the problem is solved, change the tag
'verification-needed-bionic' to 'verification-done-bionic'. If the
problem still exists, change the tag 'verification-needed-bionic' to
'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will
be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how
to enable and use -proposed. Thank you!


** Tags added: kernel-spammed-bionic-linux

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Committed
Status in linux source package in Focal:
  Fix Committed

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
  $ cd xfstests-dev
  $ make
  $ sudo su
  # mkdir /test
  # mkdir 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-03-02 Thread Ubuntu Kernel Bot
This bug is awaiting verification that the linux/5.4.0-145.162 kernel in
-proposed solves the problem. Please test the kernel and update this bug
with the results. If the problem is solved, change the tag
'verification-needed-focal' to 'verification-done-focal'. If the problem
still exists, change the tag 'verification-needed-focal' to
'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will
be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how
to enable and use -proposed. Thank you!


** Tags added: kernel-spammed-focal-linux verification-needed-focal

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Committed
Status in linux source package in Focal:
  Fix Committed

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
  $ cd xfstests-dev
  $ make
  $ sudo su
  # 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-02-25 Thread Ubuntu Kernel Bot
This bug is awaiting verification that the linux-
azure-4.15/4.15.0-1162.177 kernel in -proposed solves the problem.
Please test the kernel and update this bug with the results. If the
problem is solved, change the tag 'verification-needed-bionic' to
'verification-done-bionic'. If the problem still exists, change the tag
'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will
be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how
to enable and use -proposed. Thank you!


** Tags added: kernel-spammed-bionic-linux-azure-4.15 verification-needed-bionic

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Committed
Status in linux source package in Focal:
  Fix Committed

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
  $ cd 

[Kernel-packages] [Bug 2004132] Re: btrfs/154: rename fails with EOVERFLOW when calculating item size during item key collision

2023-02-23 Thread Luke Nowakowski-Krijger
** Changed in: linux (Ubuntu Bionic)
   Status: In Progress => Fix Committed

** Changed in: linux (Ubuntu Focal)
   Status: In Progress => Fix Committed

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2004132

Title:
  btrfs/154: rename fails with EOVERFLOW when calculating item size
  during item key collision

Status in linux package in Ubuntu:
  Fix Released
Status in linux source package in Bionic:
  Fix Committed
Status in linux source package in Focal:
  Fix Committed

Bug description:
  BugLink: https://bugs.launchpad.net/bugs/2004132

  [Impact]

  xfstests btrfs/154 fails on both Bionic and Focal, leading to a kernel
  oops and the btrfs volume being forced readonly.

  In btrfs, item key collision is allowed for some item types, namely
  dir item and inode references. When inserting items into the btree,
  there are two objects, the btrfs_item and the item data. These objects
  must fit within the btree nodesize.

  When a hash collision occurs, and we call btrfs_search_slot() to place
  the objects in the tree, when btrfs_search_slot() reaches the leaf
  node, a check is performed to see if we need to split the leaf. The
  check is incorrect, returning that we need to split the leaf, since it
  thinks that both btrfs_item and the item data need to be inserted,
  when in reality, the item can be merged with the existing one and no
  new btrfs_item will be inserted.

  split_leaf() will return EOVERFLOW from following code:

    if (extend && data_size + btrfs_item_size_nr(l, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(fs_info))
    return -EOVERFLOW;

  In the rename case, btrfs_check_dir_item_collision() is called early
  stages of treewalking, and correctly calculates the needed size,
  taking into account that a hash collision has occurred.

    data_size = sizeof(*di) + name_len;
    if (data_size + btrfs_item_size_nr(leaf, slot) +
    sizeof(struct btrfs_item) > BTRFS_LEAF_DATA_SIZE(root->fs_info))

  The two sizes reported from btrfs_check_dir_item_collision() and
  btrfs_search_slot() are different, and rename fails due to
  split_leaf() returning -EOVERFLOW, leading to transaction abort and
  forcing the volume readonly.

  Kernel oops:

  BTRFS: Transaction aborted (error -75)
  WARNING: CPU: 0 PID: 2921 at 
/build/linux-fTmV3T/linux-4.15.0/fs/btrfs/inode.c:10217 
btrfs_rename+0xcf1/0xdf0 [btrfs]
  CPU: 0 PID: 2921 Comm: python3 Not tainted 4.15.0-202-generic #213-Ubuntu
  RIP: 0010:btrfs_rename+0xcf1/0xdf0 [btrfs]
  RSP: 0018:9e6f4183fd20 EFLAGS: 00010282
  RAX:  RBX: 91a493f27b98 RCX: 0006
  RDX: 0007 RSI: 0096 RDI: 91a4bfc1b4d0
  RBP: 9e6f4183fdc0 R08: 02b4 R09: 0004
  R10:  R11: 0001 R12: 0236
  R13: 91a493f56518 R14: 91a4b6b57b40 R15: 91a493f27b98
  FS:  7f6041081740() GS:91a4bfc0() knlGS:
  CS:  0010 DS:  ES:  CR0: 80050033
  CR2: 7f6040fe84c8 CR3: 00015c8ca005 CR4: 00760ef0
  PKRU: 5554
  Call Trace:
   btrfs_rename2+0x1d/0x30 [btrfs]
   vfs_rename+0x46e/0x960
   SyS_rename+0x362/0x3c0
   do_syscall_64+0x73/0x130
   entry_SYSCALL_64_after_hwframe+0x41/0xa6
  Code: 0f ba a8 d0 cd 00 00 02 72 2b 41 83 f8 fb 0f 84 d9 00 00 00 44 89 c6 48 
c7 c7 68 43 4b c0 44 89 55 80 44 89 45 98 e8 8f 5c a6 d0 <0f> 0b 44 8b 45 98 44 
8b 55 80 44 89 55 80 44 89 c1 44 89 45 98
  ---[ end trace 9c6b87a19f4436f3 ]---
  BTRFS: error (device vdd) in btrfs_rename:10217: errno=-75 unknown
  BTRFS info (device vdd): forced readonly

  [Testcase]

  Start a fresh Bionic or Focal VM.

  Attach two scratch disks, I used standard virtio disks with 3gb of
  storage each. These disks are /dev/vdc and /dev/vdd.

  Compile xfstests:

  $ sudo apt-get install acl attr automake bc dbench dump e2fsprogs fio gawk \
  gcc git indent libacl1-dev libaio-dev libcap-dev libgdbm-dev libtool \
  libtool-bin  libuuid1 lvm2 make psmisc python3 quota sed \
  uuid-dev uuid-runtime xfsprogs linux-headers-$(uname -r) sqlite3 make
  $ sudo apt-get install  f2fs-tools ocfs2-tools udftools xfsdump \
  xfslibs-dev
  $ git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
  $ cd xfstests-dev
  $ make
  $ sudo su
  # mkdir /test
  # mkdir /scratch
  # mkfs.btrfs -f /dev/vdc
  # cat << EOF >> ./local.config
  export TEST_DEV=/dev/vdc
  export TEST_DIR=/test
  export SCRATCH_DEV=/dev/vdd
  export SCRATCH_MNT=/scratch
  EOF

  # ./check btrfs/154

  btrfs/154   _check_dmesg: something found in dmesg (see 
/home/ubuntu/xfstests-dev/results//btrfs/154.dmesg)
  - output mismatch (see /home/ubuntu/xfstests-dev/results//btrfs/154.out.bad)
  --- tests/btrfs/154.out   2023-01-28 02:53:03.566450703 +
  +++