{"push_id":865338804,"size":25,"distinct_size":25,"ref":"refs/heads/master","head":"f3996e6ac6e2bd739d8a82cc9acae0653c2d5dca","before":"ca4ba96e02e932a0c9997a40fd51253b5b2d0f9d","commits":[{"sha":"ca9e7a1c85594f61d7ffb414071e6cae82eae23a","author":{"email":"51565b4e5841e493fd669866e11ea3c7c0d781cc@gmail.com","name":"Steve French"},"message":"Allow duplicate extents in SMB3 not just SMB3.1.1\n\nEnable duplicate extents (cp --reflink) ioctl for SMB3.0 not just\nSMB3.1.1 since have verified that this works to Windows 2016\n(REFS) and additional testing done at recent plugfest with\nSMB3.0 not just SMB3.1.1  This will also make it easier\nfor Samba.\n\nSigned-off-by: Steve French <steve.french@primarydata.com>\nReviewed-by: David Disseldorp <ddiss@suse.de>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/ca9e7a1c85594f61d7ffb414071e6cae82eae23a"},{"sha":"b2a3077414fd6ff1de8972ea55e91f27bcabd913","author":{"email":"51565b4e5841e493fd669866e11ea3c7c0d781cc@gmail.com","name":"Steve French"},"message":"[SMB3] Add parsing for new mount option controlling persistent handles\n\n\"nopersistenthandles\" and \"persistenthandles\" mount options added.\nThe former will not request persistent handles on open even when\nSMB3 negotiated and Continuous Availability share.  The latter\nwill request persistent handles (as long as server notes the\ncapability in protocol negotiation) even if share is not Continuous\nAvailability share.\n\nSigned-off-by: Steve French <steve.french@primarydata.com>\nReviewed-by: Pavel Shilovsky <pshilovsky@samba.org>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/b2a3077414fd6ff1de8972ea55e91f27bcabd913"},{"sha":"b618f001a20e44f691dd0e2ffea651a40a651871","author":{"email":"51565b4e5841e493fd669866e11ea3c7c0d781cc@gmail.com","name":"Steve French"},"message":"[SMB3] Enable checking for continuous availability and persistent handle support\n\nValidate \"persistenthandles\" and \"nopersistenthandles\" mount options against\nthe support the server claims in negotiate and tree connect SMB3 responses.\n\nSigned-off-by: Steve French <steve.french@primarydata.com>\nReviewed-by: Pavel Shilovsky <pshilovsky@samba.org>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/b618f001a20e44f691dd0e2ffea651a40a651871"},{"sha":"f16dfa7cd1b588e5d7ef4b5a19ee579f11b7a41f","author":{"email":"51565b4e5841e493fd669866e11ea3c7c0d781cc@gmail.com","name":"Steve French"},"message":"[SMB3] Display persistenthandles in /proc/mounts for SMB3 shares if enabled\n\nSigned-off-by: Steve French <steve.french@primarydata.com>\nReviewed-by: Pavel Shilovsky <pshilovsky@samba.org>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/f16dfa7cd1b588e5d7ef4b5a19ee579f11b7a41f"},{"sha":"b56eae4df9ef922d5785ec4a15d54d9527cedb13","author":{"email":"51565b4e5841e493fd669866e11ea3c7c0d781cc@gmail.com","name":"Steve French"},"message":"[SMB3] Send durable handle v2 contexts when use of persistent handles required\n\nVersion 2 of the patch. Thanks to Dan Carpenter and the smatch\ntool for finding a problem in the first version of this patch.\n\nCC: Dan Carpenter <dan.carpenter@oracle.com>\nReviewed-by: Pavel Shilovsky <pshilovsky@samba.org>\nSigned-off-by: Steve French <steve.french@primarydata.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/b56eae4df9ef922d5785ec4a15d54d9527cedb13"},{"sha":"592fafe644bf3a48b9e00e182a67d301493634fc","author":{"email":"51565b4e5841e493fd669866e11ea3c7c0d781cc@gmail.com","name":"Steve French"},"message":"Add resilienthandles mount parm\n\nSince many servers (Windows clients, and non-clustered servers) do not\nsupport persistent handles but do support resilient handles, allow\nthe user to specify a mount option \"resilienthandles\" in order\nto get more reliable connections and less chance of data loss\n(at least when SMB2.1 or later).  Default resilient handle\ntimeout (120 seconds to recent Windows server) is used.\n\nReviewed-by: Pavel Shilovsky <pshilovsky@samba.org>\nSigned-off-by: Steve French <steve.french@primarydata.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/592fafe644bf3a48b9e00e182a67d301493634fc"},{"sha":"9c9464cc92668984ebed79e22b5063877a8d97db","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix extent accounting for partial direct IO writes\n\nWhen doing a write using direct IO we can end up not doing the whole write\noperation using the direct IO path, in that case we fallback to a buffered\nwrite to do the remaining IO. This happens for example if the range we are\nwriting to contains a compressed extent.\nWhen we do a partial write and fallback to buffered IO, due to the\nexistence of a compressed extent for example, we end up not adjusting the\noutstanding extents counter of our inode which ends up getting decremented\ntwice, once by the DIO ordered extent for the partial write and once again\nby btrfs_direct_IO(), resulting in an arithmetic underflow at\nextent-tree.c:drop_outstanding_extent(). For example if we have:\n\n  extents        [ prealloc extent ] [ compressed extent ]\n  offsets        A        B          C       D           E\n\nand at the moment our inode's outstanding extents counter is 0, if we do a\ndirect IO write against the range [B, D[ (which has a length smaller than\n128Mb), we end up bumping our inode's outstanding extents counter to 1, we\ncreate a DIO ordered extent for the range [B, C[ and then fallback to a\nbuffered write for the range [C, D[. The direct IO handler\n(inode.c:btrfs_direct_IO()) decrements the outstanding extents counter by\n1, leaving it with a value of 0, through a call to\nbtrfs_delalloc_release_space() and then shortly after the DIO ordered\nextent finishes and calls btrfs_delalloc_release_metadata() which ends\nup to attempt to decrement the inode's outstanding extents counter by 1,\nresulting in an assertion failure at drop_outstanding_extent() because\nthe operation would result in an arithmetic underflow (0 - 1). This\nproduces the following trace:\n\n  [125471.336838] BTRFS: assertion failed: BTRFS_I(inode)->outstanding_extents >= num_extents, file: fs/btrfs/extent-tree.c, line: 5526\n  [125471.338844] ------------[ cut here ]------------\n  [125471.340745] kernel BUG at fs/btrfs/ctree.h:4173!\n  [125471.340745] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n  [125471.340745] Modules linked in: btrfs f2fs xfs libcrc32c dm_flakey dm_mod crc32c_generic xor raid6_pq nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc loop fuse parport_pc acpi_cpufreq psmouse i2c_piix4 parport pcspkr serio_raw microcode processor evdev i2c_core button ext4 crc16 jbd2 mbcache sd_mod sg sr_mod cdrom ata_generic virtio_scsi ata_piix virtio_pci virtio_ring floppy libata virtio e1000 scsi_mod [last unloaded: btrfs]\n  [125471.340745] CPU: 10 PID: 23649 Comm: kworker/u32:1 Tainted: G        W       4.3.0-rc5-btrfs-next-17+ #1\n  [125471.340745] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014\n  [125471.340745] Workqueue: btrfs-endio-write btrfs_endio_write_helper [btrfs]\n  [125471.340745] task: ffff8804244fcf80 ti: ffff88040a118000 task.ti: ffff88040a118000\n  [125471.340745] RIP: 0010:[<ffffffffa0550da1>]  [<ffffffffa0550da1>] assfail.constprop.46+0x1e/0x20 [btrfs]\n  [125471.340745] RSP: 0018:ffff88040a11bc78  EFLAGS: 00010296\n  [125471.340745] RAX: 0000000000000075 RBX: 0000000000005000 RCX: 0000000000000000\n  [125471.340745] RDX: ffffffff81098f93 RSI: ffffffff8147c619 RDI: 00000000ffffffff\n  [125471.340745] RBP: ffff88040a11bc78 R08: 0000000000000001 R09: 0000000000000000\n  [125471.340745] R10: ffff88040a11bc08 R11: ffffffff81651000 R12: ffff8803efb4a000\n  [125471.340745] R13: ffff8803efb4a000 R14: 0000000000000000 R15: ffff8802f8e33c88\n  [125471.340745] FS:  0000000000000000(0000) GS:ffff88043dd40000(0000) knlGS:0000000000000000\n  [125471.340745] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n  [125471.340745] CR2: 00007fae7ca86095 CR3: 0000000001a0b000 CR4: 00000000000006e0\n  [125471.340745] Stack:\n  [125471.340745]  ffff88040a11bc88 ffffffffa04ca0cd ffff88040a11bcc8 ffffffffa04ceeb1\n  [125471.340745]  ffff8802f8e33940 ffff8802c93eadb0 ffff8802f8e0bf50 ffff8803efb4a000\n  [125471.340745]  0000000000000000 ffff8802f8e33c88 ffff88040a11bd38 ffffffffa04eccfa\n  [125471.340745] Call Trace:\n  [125471.340745]  [<ffffffffa04ca0cd>] drop_outstanding_extent+0x3d/0x6d [btrfs]\n  [125471.340745]  [<ffffffffa04ceeb1>] btrfs_delalloc_release_metadata+0x51/0xdd [btrfs]\n  [125471.340745]  [<ffffffffa04eccfa>] btrfs_finish_ordered_io+0x420/0x4eb [btrfs]\n  [125471.340745]  [<ffffffffa04ecdda>] finish_ordered_fn+0x15/0x17 [btrfs]\n  [125471.340745]  [<ffffffffa050e6e8>] normal_work_helper+0x14c/0x32a [btrfs]\n  [125471.340745]  [<ffffffffa050e9c8>] btrfs_endio_write_helper+0x12/0x14 [btrfs]\n  [125471.340745]  [<ffffffff81063b23>] process_one_work+0x24a/0x4ac\n  [125471.340745]  [<ffffffff81064285>] worker_thread+0x206/0x2c2\n  [125471.340745]  [<ffffffff8106407f>] ? rescuer_thread+0x2cb/0x2cb\n  [125471.340745]  [<ffffffff8106407f>] ? rescuer_thread+0x2cb/0x2cb\n  [125471.340745]  [<ffffffff8106904d>] kthread+0xef/0xf7\n  [125471.340745]  [<ffffffff81068f5e>] ? kthread_parkme+0x24/0x24\n  [125471.340745]  [<ffffffff8147d10f>] ret_from_fork+0x3f/0x70\n  [125471.340745]  [<ffffffff81068f5e>] ? kthread_parkme+0x24/0x24\n  [125471.340745] Code: a5 55 a0 48 89 e5 e8 42 50 bc e0 0f 0b 55 89 f1 48 c7 c2 f0 a8 55 a0 48 89 fe 31 c0 48 c7 c7 14 aa 55 a0 48 89 e5 e8 22 50 bc e0 <0f> 0b 0f 1f 44 00 00 55 31 c9 ba 18 00 00 00 48 89 e5 41 56 41\n  [125471.340745] RIP  [<ffffffffa0550da1>] assfail.constprop.46+0x1e/0x20 [btrfs]\n  [125471.340745]  RSP <ffff88040a11bc78>\n  [125471.539620] ---[ end trace 144259f7838b4aa4 ]---\n\nSo fix this by ensuring we adjust the outstanding extents counter when we\ndo the fallback just like we do for the case where the whole write can be\ndone through the direct IO path.\n\nWe were also adjusting the outstanding extents counter by a constant value\nof 1, which is incorrect because we were ignorning that we account extents\nin BTRFS_MAX_EXTENT_SIZE units, o fix that as well.\n\nThe following test case for fstests reproduces this issue:\n\n  seq=`basename $0`\n  seqres=$RESULT_DIR/$seq\n  echo \"QA output created by $seq\"\n  tmp=/tmp/$$\n  status=1\t# failure is the default!\n  trap \"_cleanup; exit \\$status\" 0 1 2 3 15\n\n  _cleanup()\n  {\n      rm -f $tmp.*\n  }\n\n  # get standard environment, filters and checks\n  . ./common/rc\n  . ./common/filter\n\n  # real QA test starts here\n  _need_to_be_root\n  _supported_fs btrfs\n  _supported_os Linux\n  _require_scratch\n  _require_xfs_io_command \"falloc\"\n\n  rm -f $seqres.full\n\n  _scratch_mkfs >>$seqres.full 2>&1\n  _scratch_mount \"-o compress\"\n\n  # Create a compressed extent covering the range [700K, 800K[.\n  $XFS_IO_PROG -f -s -c \"pwrite -S 0xaa -b 100K 700K 100K\" \\\n      $SCRATCH_MNT/foo | _filter_xfs_io\n\n  # Create prealloc extent covering the range [600K, 700K[.\n  $XFS_IO_PROG -c \"falloc 600K 100K\" $SCRATCH_MNT/foo\n\n  # Write 80K of data to the range [640K, 720K[ using direct IO. This\n  # range covers both the prealloc extent and the compressed extent.\n  # Because there's a compressed extent in the range we are writing to,\n  # the DIO write code path ends up only writing the first 60k of data,\n  # which goes to the prealloc extent, and then falls back to buffered IO\n  # for writing the remaining 20K of data - because that remaining data\n  # maps to a file range containing a compressed extent.\n  # When falling back to buffered IO, we used to trigger an assertion when\n  # releasing reserved space due to bad accounting of the inode's\n  # outstanding extents counter, which was set to 1 but we ended up\n  # decrementing it by 1 twice, once through the ordered extent for the\n  # 60K of data we wrote using direct IO, and once through the main direct\n  # IO handler (inode.cbtrfs_direct_IO()) because the direct IO write\n  # wrote less than 80K of data (60K).\n  $XFS_IO_PROG -d -c \"pwrite -S 0xbb -b 80K 640K 80K\" \\\n      $SCRATCH_MNT/foo | _filter_xfs_io\n\n  # Now similar test as above but for very large write operations. This\n  # triggers special cases for an inode's outstanding extents accounting,\n  # as internally btrfs logically splits extents into 128Mb units.\n  $XFS_IO_PROG -f -s \\\n      -c \"pwrite -S 0xaa -b 128M 258M 128M\" \\\n      -c \"falloc 0 258M\" \\\n      $SCRATCH_MNT/bar | _filter_xfs_io\n  $XFS_IO_PROG -d -c \"pwrite -S 0xbb -b 256M 3M 256M\" $SCRATCH_MNT/bar \\\n      | _filter_xfs_io\n\n  # Now verify the file contents are correct and that they are the same\n  # even after unmounting and mounting the fs again (or evicting the page\n  # cache).\n  #\n  # For file foo, all bytes in the range [0, 640K[ must have a value of\n  # 0x00, all bytes in the range [640K, 720K[ must have a value of 0xbb\n  # and all bytes in the range [720K, 800K[ must have a value of 0xaa.\n  #\n  # For file bar, all bytes in the range [0, 3M[ must havea value of 0x00,\n  # all bytes in the range [3M, 259M[ must have a value of 0xbb and all\n  # bytes in the range [259M, 386M[ must have a value of 0xaa.\n  #\n  echo \"File digests before remounting the file system:\"\n  md5sum $SCRATCH_MNT/foo | _filter_scratch\n  md5sum $SCRATCH_MNT/bar | _filter_scratch\n  _scratch_remount\n  echo \"File digests after remounting the file system:\"\n  md5sum $SCRATCH_MNT/foo | _filter_scratch\n  md5sum $SCRATCH_MNT/bar | _filter_scratch\n\n  status=0\n  exit\n\nFixes: e1cbbfa5f5aa (\"Btrfs: fix outstanding_extents accounting in DIO\")\nFixes: 3e05bde8c3c2 (\"Btrfs: only adjust outstanding_extents when we do a short write\")\nSigned-off-by: Filipe Manana <fdmanana@suse.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/9c9464cc92668984ebed79e22b5063877a8d97db"},{"sha":"7343dd61fd1b57c40cc06a5b5b5386df7f73c3ac","author":{"email":"ee937cfcc16cf790ab2b37c6354b6c3019afbce8@gmail.com","name":"Justin Maggard"},"message":"btrfs: qgroup: exit the rescan worker during umount\n\nI was hitting a consistent NULL pointer dereference during shutdown that\nshowed the trace running through end_workqueue_bio().  I traced it back to\nthe endio_meta_workers workqueue being poked after it had already been\ndestroyed.\n\nEventually I found that the root cause was a qgroup rescan that was still\nin progress while we were stopping all the btrfs workers.\n\nCurrently we explicitly pause balance and scrub operations in\nclose_ctree(), but we do nothing to stop the qgroup rescan.  We should\nprobably be doing the same for qgroup rescan, but that's a much larger\nchange.  This small change is good enough to allow me to unmount without\ncrashing.\n\nSigned-off-by: Justin Maggard <jmaggard@netgear.com>\nReviewed-by: Filipe Manana <fdmanana@suse.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/7343dd61fd1b57c40cc06a5b5b5386df7f73c3ac"},{"sha":"190631f1c8cb7e4d5c27ff87e22ed53817e78759","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix race waiting for qgroup rescan worker\n\nWe were initializing the completion (fs_info->qgroup_rescan_completion)\nobject after releasing the qgroup rescan lock, which gives a small time\nwindow for a rescan waiter to not actually wait for the rescan worker\nto finish. Example:\n\n         CPU 1                                                     CPU 2\n\n fs_info->qgroup_rescan_completion->done is 0\n\n btrfs_qgroup_rescan_worker()\n   complete_all(&fs_info->qgroup_rescan_completion)\n     sets fs_info->qgroup_rescan_completion->done\n     to UINT_MAX / 2\n\n ... do some other stuff ....\n\n qgroup_rescan_init()\n   mutex_lock(&fs_info->qgroup_rescan_lock)\n   set flag BTRFS_QGROUP_STATUS_FLAG_RESCAN\n     in fs_info->qgroup_flags\n   mutex_unlock(&fs_info->qgroup_rescan_lock)\n\n                                                       btrfs_qgroup_wait_for_completion()\n                                                         mutex_lock(&fs_info->qgroup_rescan_lock)\n                                                         sees flag BTRFS_QGROUP_STATUS_FLAG_RESCAN\n                                                           in fs_info->qgroup_flags\n                                                         mutex_unlock(&fs_info->qgroup_rescan_lock)\n\n                                                         wait_for_completion_interruptible(\n                                                           &fs_info->qgroup_rescan_completion)\n\n                                                           fs_info->qgroup_rescan_completion->done\n                                                           is > 0 so it returns immediately\n\n  init_completion(&fs_info->qgroup_rescan_completion)\n    sets fs_info->qgroup_rescan_completion->done to 0\n\nSo fix this by initializing the completion object while holding the mutex\nfs_info->qgroup_rescan_lock.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/190631f1c8cb7e4d5c27ff87e22ed53817e78759"},{"sha":"3b2ba7b31d56c3d8f57cd5d32b8fb5101ab446e4","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix sleeping inside atomic context in qgroup rescan worker\n\nWe are holding a btree path with spinning locks and then we attempt to\nclone an extent buffer, which calls kmem_cache_alloc() and this function\ncan sleep, causing the following trace to be reported on a debug kernel:\n\n[107118.218536] BUG: sleeping function called from invalid context at mm/slab.c:2871\n[107118.224110] in_atomic(): 1, irqs_disabled(): 0, pid: 19148, name: kworker/u32:3\n[107118.226120] INFO: lockdep is turned off.\n[107118.226843] Preemption disabled at:[<ffffffffa05ffa22>] btrfs_clear_lock_blocking_rw+0x96/0xea [btrfs]\n\n[107118.229175] CPU: 3 PID: 19148 Comm: kworker/u32:3 Tainted: G        W       4.3.0-rc5-btrfs-next-17+ #1\n[107118.231326] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014\n[107118.233687] Workqueue: btrfs-qgroup-rescan btrfs_qgroup_rescan_helper [btrfs]\n[107118.236835]  0000000000000000 ffff880424bf3b78 ffffffff812566f4 0000000000000000\n[107118.238369]  ffff880424bf3ba0 ffffffff81070664 ffffffff817f1cd5 0000000000000b37\n[107118.239769]  0000000000000000 ffff880424bf3bc8 ffffffff8107070a 0000000000008850\n[107118.241244] Call Trace:\n[107118.241729]  [<ffffffff812566f4>] dump_stack+0x4e/0x79\n[107118.242602]  [<ffffffff81070664>] ___might_sleep+0x23a/0x241\n[107118.243586]  [<ffffffff8107070a>] __might_sleep+0x9f/0xa6\n[107118.244532]  [<ffffffff8115af70>] cache_alloc_debugcheck_before+0x25/0x36\n[107118.245939]  [<ffffffff8115d52b>] kmem_cache_alloc+0x50/0x215\n[107118.246930]  [<ffffffffa05e627e>] __alloc_extent_buffer+0x2a/0x11f [btrfs]\n[107118.248121]  [<ffffffffa05ecb1a>] btrfs_clone_extent_buffer+0x3d/0xdd [btrfs]\n[107118.249451]  [<ffffffffa06239ea>] btrfs_qgroup_rescan_worker+0x16d/0x434 [btrfs]\n[107118.250755]  [<ffffffff81087481>] ? arch_local_irq_save+0x9/0xc\n[107118.251754]  [<ffffffffa05f7952>] normal_work_helper+0x14c/0x32a [btrfs]\n[107118.252899]  [<ffffffffa05f7952>] ? normal_work_helper+0x14c/0x32a [btrfs]\n[107118.254195]  [<ffffffffa05f7c82>] btrfs_qgroup_rescan_helper+0x12/0x14 [btrfs]\n[107118.255436]  [<ffffffff81063b23>] process_one_work+0x24a/0x4ac\n[107118.263690]  [<ffffffff81064285>] worker_thread+0x206/0x2c2\n[107118.264888]  [<ffffffff8106407f>] ? rescuer_thread+0x2cb/0x2cb\n[107118.267413]  [<ffffffff8106904d>] kthread+0xef/0xf7\n[107118.268417]  [<ffffffff81068f5e>] ? kthread_parkme+0x24/0x24\n[107118.269505]  [<ffffffff8147d10f>] ret_from_fork+0x3f/0x70\n[107118.270491]  [<ffffffff81068f5e>] ? kthread_parkme+0x24/0x24\n\nSo just use blocking locks for our path to solve this.\nThis fixes the patch titled:\n  \"btrfs: qgroup: Don't copy extent buffer to do qgroup rescan\"\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/3b2ba7b31d56c3d8f57cd5d32b8fb5101ab446e4"},{"sha":"aeafbf8486c9e2bd53f5cc3c10c0b7fd7149d69c","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix race leading to incorrect item deletion when dropping extents\n\nWhile running a stress test I got the following warning triggered:\n\n  [191627.672810] ------------[ cut here ]------------\n  [191627.673949] WARNING: CPU: 8 PID: 8447 at fs/btrfs/file.c:779 __btrfs_drop_extents+0x391/0xa50 [btrfs]()\n  (...)\n  [191627.701485] Call Trace:\n  [191627.702037]  [<ffffffff8145f077>] dump_stack+0x4f/0x7b\n  [191627.702992]  [<ffffffff81095de5>] ? console_unlock+0x356/0x3a2\n  [191627.704091]  [<ffffffff8104b3b0>] warn_slowpath_common+0xa1/0xbb\n  [191627.705380]  [<ffffffffa0664499>] ? __btrfs_drop_extents+0x391/0xa50 [btrfs]\n  [191627.706637]  [<ffffffff8104b46d>] warn_slowpath_null+0x1a/0x1c\n  [191627.707789]  [<ffffffffa0664499>] __btrfs_drop_extents+0x391/0xa50 [btrfs]\n  [191627.709155]  [<ffffffff8115663c>] ? cache_alloc_debugcheck_after.isra.32+0x171/0x1d0\n  [191627.712444]  [<ffffffff81155007>] ? kmemleak_alloc_recursive.constprop.40+0x16/0x18\n  [191627.714162]  [<ffffffffa06570c9>] insert_reserved_file_extent.constprop.40+0x83/0x24e [btrfs]\n  [191627.715887]  [<ffffffffa065422b>] ? start_transaction+0x3bb/0x610 [btrfs]\n  [191627.717287]  [<ffffffffa065b604>] btrfs_finish_ordered_io+0x273/0x4e2 [btrfs]\n  [191627.728865]  [<ffffffffa065b888>] finish_ordered_fn+0x15/0x17 [btrfs]\n  [191627.730045]  [<ffffffffa067d688>] normal_work_helper+0x14c/0x32c [btrfs]\n  [191627.731256]  [<ffffffffa067d96a>] btrfs_endio_write_helper+0x12/0x14 [btrfs]\n  [191627.732661]  [<ffffffff81061119>] process_one_work+0x24c/0x4ae\n  [191627.733822]  [<ffffffff810615b0>] worker_thread+0x206/0x2c2\n  [191627.734857]  [<ffffffff810613aa>] ? process_scheduled_works+0x2f/0x2f\n  [191627.736052]  [<ffffffff810613aa>] ? process_scheduled_works+0x2f/0x2f\n  [191627.737349]  [<ffffffff810669a6>] kthread+0xef/0xf7\n  [191627.738267]  [<ffffffff810f3b3a>] ? time_hardirqs_on+0x15/0x28\n  [191627.739330]  [<ffffffff810668b7>] ? __kthread_parkme+0xad/0xad\n  [191627.741976]  [<ffffffff81465592>] ret_from_fork+0x42/0x70\n  [191627.743080]  [<ffffffff810668b7>] ? __kthread_parkme+0xad/0xad\n  [191627.744206] ---[ end trace bbfddacb7aaada8d ]---\n\n  $ cat -n fs/btrfs/file.c\n  691  int __btrfs_drop_extents(struct btrfs_trans_handle *trans,\n  (...)\n  758                  btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);\n  759                  if (key.objectid > ino ||\n  760                      key.type > BTRFS_EXTENT_DATA_KEY || key.offset >= end)\n  761                          break;\n  762\n  763                  fi = btrfs_item_ptr(leaf, path->slots[0],\n  764                                      struct btrfs_file_extent_item);\n  765                  extent_type = btrfs_file_extent_type(leaf, fi);\n  766\n  767                  if (extent_type == BTRFS_FILE_EXTENT_REG ||\n  768                      extent_type == BTRFS_FILE_EXTENT_PREALLOC) {\n  (...)\n  774                  } else if (extent_type == BTRFS_FILE_EXTENT_INLINE) {\n  (...)\n  778                  } else {\n  779                          WARN_ON(1);\n  780                          extent_end = search_start;\n  781                  }\n  (...)\n\nThis happened because the item we were processing did not match a file\nextent item (its key type != BTRFS_EXTENT_DATA_KEY), and even on this\ncase we cast the item to a struct btrfs_file_extent_item pointer and\nthen find a type field value that does not match any of the expected\nvalues (BTRFS_FILE_EXTENT_[REG|PREALLOC|INLINE]). This scenario happens\ndue to a tiny time window where a race can happen as exemplified below.\nFor example, consider the following scenario where we're using the\nNO_HOLES feature and we have the following two neighbour leafs:\n\n               Leaf X (has N items)                    Leaf Y\n\n[ ... (257 INODE_ITEM 0) (257 INODE_REF 256) ]  [ (257 EXTENT_DATA 8192), ... ]\n          slot N - 2         slot N - 1              slot 0\n\nOur inode 257 has an implicit hole in the range [0, 8K[ (implicit rather\nthan explicit because NO_HOLES is enabled). Now if our inode has an\nordered extent for the range [4K, 8K[ that is finishing, the following\ncan happen:\n\n          CPU 1                                       CPU 2\n\n  btrfs_finish_ordered_io()\n    insert_reserved_file_extent()\n      __btrfs_drop_extents()\n         Searches for the key\n          (257 EXTENT_DATA 4096) through\n          btrfs_lookup_file_extent()\n\n         Key not found and we get a path where\n         path->nodes[0] == leaf X and\n         path->slots[0] == N\n\n         Because path->slots[0] is >=\n         btrfs_header_nritems(leaf X), we call\n         btrfs_next_leaf()\n\n         btrfs_next_leaf() releases the path\n\n                                                  inserts key\n                                                  (257 INODE_REF 4096)\n                                                  at the end of leaf X,\n                                                  leaf X now has N + 1 keys,\n                                                  and the new key is at\n                                                  slot N\n\n         btrfs_next_leaf() searches for\n         key (257 INODE_REF 256), with\n         path->keep_locks set to 1,\n         because it was the last key it\n         saw in leaf X\n\n           finds it in leaf X again and\n           notices it's no longer the last\n           key of the leaf, so it returns 0\n           with path->nodes[0] == leaf X and\n           path->slots[0] == N (which is now\n           < btrfs_header_nritems(leaf X)),\n           pointing to the new key\n           (257 INODE_REF 4096)\n\n         __btrfs_drop_extents() casts the\n         item at path->nodes[0], slot\n         path->slots[0], to a struct\n         btrfs_file_extent_item - it does\n         not skip keys for the target\n         inode with a type less than\n         BTRFS_EXTENT_DATA_KEY\n         (BTRFS_INODE_REF_KEY < BTRFS_EXTENT_DATA_KEY)\n\n         sees a bogus value for the type\n         field triggering the WARN_ON in\n         the trace shown above, and sets\n         extent_end = search_start (4096)\n\n         does the if-then-else logic to\n         fixup 0 length extent items created\n         by a past bug from hole punching:\n\n           if (extent_end == key.offset &&\n               extent_end >= search_start)\n               goto delete_extent_item;\n\n         that evaluates to true and it ends\n         up deleting the key pointed to by\n         path->slots[0], (257 INODE_REF 4096),\n         from leaf X\n\nThe same could happen for example for a xattr that ends up having a key\nwith an offset value that matches search_start (very unlikely but not\nimpossible).\n\nSo fix this by ensuring that keys smaller than BTRFS_EXTENT_DATA_KEY are\nskipped, never casted to struct btrfs_file_extent_item and never deleted\nby accident. Also protect against the unexpected case of getting a key\nfor a lower inode number by skipping that key and issuing a warning.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Filipe Manana <fdmanana@suse.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/aeafbf8486c9e2bd53f5cc3c10c0b7fd7149d69c"},{"sha":"1d512cb77bdbda80f0dd0620a3b260d697fd581d","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix race leading to BUG_ON when running delalloc for nodatacow\n\nIf we are using the NO_HOLES feature, we have a tiny time window when\nrunning delalloc for a nodatacow inode where we can race with a concurrent\nlink or xattr add operation leading to a BUG_ON.\n\nThis happens because at run_delalloc_nocow() we end up casting a leaf item\nof type BTRFS_INODE_[REF|EXTREF]_KEY or of type BTRFS_XATTR_ITEM_KEY to a\nfile extent item (struct btrfs_file_extent_item) and then analyse its\nextent type field, which won't match any of the expected extent types\n(values BTRFS_FILE_EXTENT_[REG|PREALLOC|INLINE]) and therefore trigger an\nexplicit BUG_ON(1).\n\nThe following sequence diagram shows how the race happens when running a\nno-cow dellaloc range [4K, 8K[ for inode 257 and we have the following\nneighbour leafs:\n\n             Leaf X (has N items)                    Leaf Y\n\n [ ... (257 INODE_ITEM 0) (257 INODE_REF 256) ]  [ (257 EXTENT_DATA 8192), ... ]\n              slot N - 2         slot N - 1              slot 0\n\n (Note the implicit hole for inode 257 regarding the [0, 8K[ range)\n\n       CPU 1                                         CPU 2\n\n run_dealloc_nocow()\n   btrfs_lookup_file_extent()\n     --> searches for a key with value\n         (257 EXTENT_DATA 4096) in the\n         fs/subvol tree\n     --> returns us a path with\n         path->nodes[0] == leaf X and\n         path->slots[0] == N\n\n   because path->slots[0] is >=\n   btrfs_header_nritems(leaf X), it\n   calls btrfs_next_leaf()\n\n   btrfs_next_leaf()\n     --> releases the path\n\n                                              hard link added to our inode,\n                                              with key (257 INODE_REF 500)\n                                              added to the end of leaf X,\n                                              so leaf X now has N + 1 keys\n\n     --> searches for the key\n         (257 INODE_REF 256), because\n         it was the last key in leaf X\n         before it released the path,\n         with path->keep_locks set to 1\n\n     --> ends up at leaf X again and\n         it verifies that the key\n         (257 INODE_REF 256) is no longer\n         the last key in the leaf, so it\n         returns with path->nodes[0] ==\n         leaf X and path->slots[0] == N,\n         pointing to the new item with\n         key (257 INODE_REF 500)\n\n   the loop iteration of run_dealloc_nocow()\n   does not break out the loop and continues\n   because the key referenced in the path\n   at path->nodes[0] and path->slots[0] is\n   for inode 257, its type is < BTRFS_EXTENT_DATA_KEY\n   and its offset (500) is less then our delalloc\n   range's end (8192)\n\n   the item pointed by the path, an inode reference item,\n   is (incorrectly) interpreted as a file extent item and\n   we get an invalid extent type, leading to the BUG_ON(1):\n\n   if (extent_type == BTRFS_FILE_EXTENT_REG ||\n      extent_type == BTRFS_FILE_EXTENT_PREALLOC) {\n       (...)\n   } else if (extent_type == BTRFS_FILE_EXTENT_INLINE) {\n       (...)\n   } else {\n       BUG_ON(1)\n   }\n\nThe same can happen if a xattr is added concurrently and ends up having\na key with an offset smaller then the delalloc's range end.\n\nSo fix this by skipping keys with a type smaller than\nBTRFS_EXTENT_DATA_KEY.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Filipe Manana <fdmanana@suse.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/1d512cb77bdbda80f0dd0620a3b260d697fd581d"},{"sha":"7b52e2793a58af61b5d349c2c080437a437a4edb","author":{"email":"51565b4e5841e493fd669866e11ea3c7c0d781cc@gmail.com","name":"Steve French"},"message":"Allow copy offload (CopyChunk) across shares\n\nFSCTL_SRV_COPYCHUNK_WRITE only requires that the source and target\nbe on the same server (not the same volume or same share),\nso relax the existing check (which required them to be on\nthe same share). Note that this works to Windows (and presumably\nmost other NAS) but Samba requires that the source\nand target be on the same share.  Moving a file across\nshares is a common use case and can be very heplful (100x faster).\n\nSigned-off-by: Steve French <steve.french@primarydata.com>\nReviewed-by: David Disseldorp <ddiss@samba.org>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/7b52e2793a58af61b5d349c2c080437a437a4edb"},{"sha":"f1cd1f0b7d1b5d4aaa5711e8f4e4898b0045cb6d","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix race when listing an inode's xattrs\n\nWhen listing a inode's xattrs we have a time window where we race against\na concurrent operation for adding a new hard link for our inode that makes\nus not return any xattr to user space. In order for this to happen, the\nfirst xattr of our inode needs to be at slot 0 of a leaf and the previous\nleaf must still have room for an inode ref (or extref) item, and this can\nhappen because an inode's listxattrs callback does not lock the inode's\ni_mutex (nor does the VFS does it for us), but adding a hard link to an\ninode makes the VFS lock the inode's i_mutex before calling the inode's\nlink callback.\n\nIf we have the following leafs:\n\n               Leaf X (has N items)                    Leaf Y\n\n [ ... (257 INODE_ITEM 0) (257 INODE_REF 256) ]  [ (257 XATTR_ITEM 12345), ... ]\n           slot N - 2         slot N - 1              slot 0\n\nThe race illustrated by the following sequence diagram is possible:\n\n       CPU 1                                               CPU 2\n\n  btrfs_listxattr()\n\n    searches for key (257 XATTR_ITEM 0)\n\n    gets path with path->nodes[0] == leaf X\n    and path->slots[0] == N\n\n    because path->slots[0] is >=\n    btrfs_header_nritems(leaf X), it calls\n    btrfs_next_leaf()\n\n    btrfs_next_leaf()\n      releases the path\n\n                                                   adds key (257 INODE_REF 666)\n                                                   to the end of leaf X (slot N),\n                                                   and leaf X now has N + 1 items\n\n      searches for the key (257 INODE_REF 256),\n      with path->keep_locks == 1, because that\n      is the last key it saw in leaf X before\n      releasing the path\n\n      ends up at leaf X again and it verifies\n      that the key (257 INODE_REF 256) is no\n      longer the last key in leaf X, so it\n      returns with path->nodes[0] == leaf X\n      and path->slots[0] == N, pointing to\n      the new item with key (257 INODE_REF 666)\n\n    btrfs_listxattr's loop iteration sees that\n    the type of the key pointed by the path is\n    different from the type BTRFS_XATTR_ITEM_KEY\n    and so it breaks the loop and stops looking\n    for more xattr items\n      --> the application doesn't get any xattr\n          listed for our inode\n\nSo fix this by breaking the loop only if the key's type is greater than\nBTRFS_XATTR_ITEM_KEY and skip the current key if its type is smaller.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Filipe Manana <fdmanana@suse.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/f1cd1f0b7d1b5d4aaa5711e8f4e4898b0045cb6d"},{"sha":"9799d2c32bef6fba098fbef763002bc8d4851a2c","author":{"email":"aacdd228f50c574b28b524b23f12fb9d52d6e0e3@cn.fujitsu.com","name":"Zhao Lei"},"message":"btrfs: scrub: set error stats when tree block spanning stripes\n\nIt is better to show error stats to user when we found tree block\nspanning stripes.\n\nOn a btrfs created by old version of btrfs-convert:\nBefore patch:\n  # btrfs scrub start -B /dev/vdh\n  scrub done for 8b342d35-2904-41ab-b3cb-2f929709cf47\n          scrub started at Tue Aug 25 21:19:09 2015 and finished after 00:00:00\n          total bytes scrubbed: 53.54MiB with 0 errors\n  # dmesg\n  ...\n  [  128.711434] BTRFS error (device vdh): scrub: tree block 27054080 spanning stripes, ignored. logical=27000832\n  [  128.712744] BTRFS error (device vdh): scrub: tree block 27054080 spanning stripes, ignored. logical=27066368\n  ...\n\nAfter patch:\n  # btrfs scrub start -B /dev/vdh\n  scrub done for ff7f844b-7a4e-4b1a-88a9-8252ab25be1b\n          scrub started at Tue Aug 25 21:42:29 2015 and finished after 00:00:00\n          total bytes scrubbed: 53.60MiB with 2 errors\n          error details:\n          corrected errors: 0, uncorrectable errors: 2, unverified errors: 0\n  ERROR: There are uncorrectable errors.\n  # dmesg\n  ...omit...\n  #\n\nSigned-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>\nSigned-off-by: Chris Mason <clm@fb.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/9799d2c32bef6fba098fbef763002bc8d4851a2c"},{"sha":"4734b7ed79e1230602927a38bc4d04dbe9dd09c1","author":{"email":"aacdd228f50c574b28b524b23f12fb9d52d6e0e3@cn.fujitsu.com","name":"Zhao Lei"},"message":"btrfs: scrub: setup all fields for sblock_to_check\n\nscrub_setup_recheck_block() isn't setup all necessary fields for\nsblock_to_check because history reason.\n\nSo current code need more arguments in severial functions,\nand more local variables, just to passing these lacked values to\nnecessary place.\n\nThis patch setup above fields to sblock_to_check in\nscrub_setup_recheck_block(), for:\n1: more cleanup for function arg, local variable\n2: to make sblock_to_check complete, then we can use sblock_to_check\n   without concern about some uninitialized member.\n\nSigned-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>\nSigned-off-by: Chris Mason <clm@fb.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/4734b7ed79e1230602927a38bc4d04dbe9dd09c1"},{"sha":"772d233f5dec86e38a96e58cc995e7b04ab4ec68","author":{"email":"aacdd228f50c574b28b524b23f12fb9d52d6e0e3@cn.fujitsu.com","name":"Zhao Lei"},"message":"btrfs: Reset sblock->xxx_error stats before calling scrub_recheck_block_checksum\n\nWe should reset sblock->xxx_error stats before calling\nscrub_recheck_block_checksum().\n\nCurrent code run correctly because all sblock are allocated by\nk[cz]alloc(), and the error stats are not got changed.\n\nSigned-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>\nSigned-off-by: Chris Mason <clm@fb.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/772d233f5dec86e38a96e58cc995e7b04ab4ec68"},{"sha":"ba7cf9882bd25bed77aad7dd8865e80c7ae0070a","author":{"email":"aacdd228f50c574b28b524b23f12fb9d52d6e0e3@cn.fujitsu.com","name":"Zhao Lei"},"message":"btrfs: Use scrub_checksum_data and scrub_checksum_tree_block for scrub_recheck_block_checksum\n\nWe can use existing scrub_checksum_data() and scrub_checksum_tree_block()\nfor scrub_recheck_block_checksum(), instead of write duplicated code.\n\nSigned-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>\nSigned-off-by: Chris Mason <clm@fb.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/ba7cf9882bd25bed77aad7dd8865e80c7ae0070a"},{"sha":"affe4a5ae18baa2ab67af42eb21d7d734b851819","author":{"email":"aacdd228f50c574b28b524b23f12fb9d52d6e0e3@cn.fujitsu.com","name":"Zhao Lei"},"message":"btrfs: Reduce unnecessary arguments in scrub_recheck_block\n\nWe don't need pass so many arguments for recheck sblock now,\nthis patch cleans them.\n\nSigned-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>\nSigned-off-by: Chris Mason <clm@fb.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/affe4a5ae18baa2ab67af42eb21d7d734b851819"},{"sha":"3b5753ec23597b05fd41d3f19ef582d6af1a6477","author":{"email":"aacdd228f50c574b28b524b23f12fb9d52d6e0e3@cn.fujitsu.com","name":"Zhao Lei"},"message":"btrfs: Remove len argument from scrub_find_csum\n\nIt is useless.\n\nSigned-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>\nSigned-off-by: Chris Mason <clm@fb.com>","distinct":true,"url":"https://api.github.com/repos/OpenChannelSSD/linux/commits/3b5753ec23597b05fd41d3f19ef582d6af1a6477"}]}