btrfs-progs/task-utils.c

144 lines
2.9 KiB
C
Raw Permalink Normal View History

/*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public
* License v2 as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public
* License along with this program; if not, write to the
* Free Software Foundation, Inc., 59 Temple Place - Suite 330,
* Boston, MA 021110-1307, USA.
*/
#include <pthread.h>
#include <sys/timerfd.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include "task-utils.h"
struct task_info *task_init(void *(*threadfn)(void *), int (*postfn)(void *),
void *thread_private)
{
struct task_info *info = calloc(1, sizeof(struct task_info));
if (!info)
return NULL;
info->private_data = thread_private;
info->threadfn = threadfn;
info->postfn = postfn;
return info;
}
int task_start(struct task_info *info)
{
int ret;
if (!info)
return -1;
if (!info->threadfn)
return -1;
ret = pthread_create(&info->id, NULL, info->threadfn,
info->private_data);
btrfs-progs: Fix wrong address accessing by subthread in btrfs-convert btrfs-convert sometimes show 'Assertion failed' in converting a nearly blank file system, as: create btrfs filesystem: blocksize: 4096 nodesize: 16384 features: extref, skinny-metadata (default) creating btrfs metadata. creating ext2fs image file. trans 7 running 5 ctree.c:363: btrfs_cow_block: Assertion `1` failed. btrfs-convert(btrfs_cow_block+0x92)[0x40acaf] btrfs-convert(btrfs_search_slot+0x1cb)[0x40c50f] btrfs-convert(btrfs_csum_file_block+0x20f)[0x41d83a] btrfs-convert[0x43422d] btrfs-convert[0x4342cd] btrfs-convert[0x4345ca] btrfs-convert[0x434767] btrfs-convert[0x435770] btrfs-convert[0x439748] btrfs-convert(main+0x13f8)[0x43b09d] /lib64/libc.so.6(__libc_start_main+0xfd)[0x335e01ecdd] btrfs-convert[0x407649] Reason is complex: 1: main thread allocated a block of memory, shared with sub thread 2: main thread killed sub thread, and free above memory 3: main thread malloc a new one(in same address), and use it 4: sub thread(which is not really quit), write into this address, and caused this bug. By adding some debug lines into code, we can see following output: create btrfs filesystem: blocksize: 4096 nodesize: 16384 features: extref, skinny-metadata (default) creating btrfs metadata. 1: ctx(0x7ffe1abde230)->info=0xc65b80 2: task_period_start: will create periodic.timer_fd 3: task_stop: info->periodic.timer_fd = NULL 4: task_stop: begin pthread_cancel info->id=-1746053376 5: task_stop: done pthread_cancel ret=0 6: task_stop: begin info->postfn 7: task_period_stop: periodic.timer_fd NULL 8: task_stop: done info->postfn 9: task_stop: done all 10: creating ext2fs image file. trans 7 running 5 11: task_period_start: create periodic.timer_fd done info->periodic.timer_fd(0xc65b80)=7 12: btrfs_cow_block: root->fs_info->generation(0xc63568) = 5 trans->transid(0xc65b80)=7 13: ctree.c:368: btrfs_cow_block: Assertion `1` failed. ./btrfs-convert(btrfs_cow_block+0xda)[0x40ad37] ./btrfs-convert(btrfs_search_slot+0x1cb)[0x40c5b4] ./btrfs-convert(btrfs_insert_empty_items+0xac)[0x40d9f6] ./btrfs-convert(btrfs_record_file_extent+0xc0)[0x4183fe] ./btrfs-convert[0x435796] ./btrfs-convert[0x439b0c] ./btrfs-convert(main+0x13f8)[0x43b45d] /lib64/libc.so.6(__libc_start_main+0xfd)[0x335e01ecdd] ./btrfs-convert[0x407689] Conclusion: a: subthread should exit before step 5, but it is still running in step 11 b: task_stop() hadn't close periodic.timer_fd in step3, because periodic.timer_fd is not initialized yet. c. address of 0xc65b80 is overwrited by subthread in step 11, but this address is freed and re-malloc by main thread before step 10, and used for trans->transid. d: trans->transid which is overwrite by subthread caused error in step 13. Fix: pthread_cancel() only send a cancellation request to the thread, thread will quit in next cancellation point by default. To make sub thread quit in time, this patch add pthread_join() after pthread_cancel() call. And to make pthread_join() works, pthread_detach() is removed. Signed-off-by: Zhao Lei <zhaolei@cn.fujitsu.com> Signed-off-by: David Sterba <dsterba@suse.com>
2015-07-27 12:24:26 +00:00
if (ret)
info->id = 0;
return ret;
}
void task_stop(struct task_info *info)
{
if (!info)
return;
btrfs-progs: Fix wrong address accessing by subthread in btrfs-convert btrfs-convert sometimes show 'Assertion failed' in converting a nearly blank file system, as: create btrfs filesystem: blocksize: 4096 nodesize: 16384 features: extref, skinny-metadata (default) creating btrfs metadata. creating ext2fs image file. trans 7 running 5 ctree.c:363: btrfs_cow_block: Assertion `1` failed. btrfs-convert(btrfs_cow_block+0x92)[0x40acaf] btrfs-convert(btrfs_search_slot+0x1cb)[0x40c50f] btrfs-convert(btrfs_csum_file_block+0x20f)[0x41d83a] btrfs-convert[0x43422d] btrfs-convert[0x4342cd] btrfs-convert[0x4345ca] btrfs-convert[0x434767] btrfs-convert[0x435770] btrfs-convert[0x439748] btrfs-convert(main+0x13f8)[0x43b09d] /lib64/libc.so.6(__libc_start_main+0xfd)[0x335e01ecdd] btrfs-convert[0x407649] Reason is complex: 1: main thread allocated a block of memory, shared with sub thread 2: main thread killed sub thread, and free above memory 3: main thread malloc a new one(in same address), and use it 4: sub thread(which is not really quit), write into this address, and caused this bug. By adding some debug lines into code, we can see following output: create btrfs filesystem: blocksize: 4096 nodesize: 16384 features: extref, skinny-metadata (default) creating btrfs metadata. 1: ctx(0x7ffe1abde230)->info=0xc65b80 2: task_period_start: will create periodic.timer_fd 3: task_stop: info->periodic.timer_fd = NULL 4: task_stop: begin pthread_cancel info->id=-1746053376 5: task_stop: done pthread_cancel ret=0 6: task_stop: begin info->postfn 7: task_period_stop: periodic.timer_fd NULL 8: task_stop: done info->postfn 9: task_stop: done all 10: creating ext2fs image file. trans 7 running 5 11: task_period_start: create periodic.timer_fd done info->periodic.timer_fd(0xc65b80)=7 12: btrfs_cow_block: root->fs_info->generation(0xc63568) = 5 trans->transid(0xc65b80)=7 13: ctree.c:368: btrfs_cow_block: Assertion `1` failed. ./btrfs-convert(btrfs_cow_block+0xda)[0x40ad37] ./btrfs-convert(btrfs_search_slot+0x1cb)[0x40c5b4] ./btrfs-convert(btrfs_insert_empty_items+0xac)[0x40d9f6] ./btrfs-convert(btrfs_record_file_extent+0xc0)[0x4183fe] ./btrfs-convert[0x435796] ./btrfs-convert[0x439b0c] ./btrfs-convert(main+0x13f8)[0x43b45d] /lib64/libc.so.6(__libc_start_main+0xfd)[0x335e01ecdd] ./btrfs-convert[0x407689] Conclusion: a: subthread should exit before step 5, but it is still running in step 11 b: task_stop() hadn't close periodic.timer_fd in step3, because periodic.timer_fd is not initialized yet. c. address of 0xc65b80 is overwrited by subthread in step 11, but this address is freed and re-malloc by main thread before step 10, and used for trans->transid. d: trans->transid which is overwrite by subthread caused error in step 13. Fix: pthread_cancel() only send a cancellation request to the thread, thread will quit in next cancellation point by default. To make sub thread quit in time, this patch add pthread_join() after pthread_cancel() call. And to make pthread_join() works, pthread_detach() is removed. Signed-off-by: Zhao Lei <zhaolei@cn.fujitsu.com> Signed-off-by: David Sterba <dsterba@suse.com>
2015-07-27 12:24:26 +00:00
if (info->id > 0) {
pthread_cancel(info->id);
btrfs-progs: Fix wrong address accessing by subthread in btrfs-convert btrfs-convert sometimes show 'Assertion failed' in converting a nearly blank file system, as: create btrfs filesystem: blocksize: 4096 nodesize: 16384 features: extref, skinny-metadata (default) creating btrfs metadata. creating ext2fs image file. trans 7 running 5 ctree.c:363: btrfs_cow_block: Assertion `1` failed. btrfs-convert(btrfs_cow_block+0x92)[0x40acaf] btrfs-convert(btrfs_search_slot+0x1cb)[0x40c50f] btrfs-convert(btrfs_csum_file_block+0x20f)[0x41d83a] btrfs-convert[0x43422d] btrfs-convert[0x4342cd] btrfs-convert[0x4345ca] btrfs-convert[0x434767] btrfs-convert[0x435770] btrfs-convert[0x439748] btrfs-convert(main+0x13f8)[0x43b09d] /lib64/libc.so.6(__libc_start_main+0xfd)[0x335e01ecdd] btrfs-convert[0x407649] Reason is complex: 1: main thread allocated a block of memory, shared with sub thread 2: main thread killed sub thread, and free above memory 3: main thread malloc a new one(in same address), and use it 4: sub thread(which is not really quit), write into this address, and caused this bug. By adding some debug lines into code, we can see following output: create btrfs filesystem: blocksize: 4096 nodesize: 16384 features: extref, skinny-metadata (default) creating btrfs metadata. 1: ctx(0x7ffe1abde230)->info=0xc65b80 2: task_period_start: will create periodic.timer_fd 3: task_stop: info->periodic.timer_fd = NULL 4: task_stop: begin pthread_cancel info->id=-1746053376 5: task_stop: done pthread_cancel ret=0 6: task_stop: begin info->postfn 7: task_period_stop: periodic.timer_fd NULL 8: task_stop: done info->postfn 9: task_stop: done all 10: creating ext2fs image file. trans 7 running 5 11: task_period_start: create periodic.timer_fd done info->periodic.timer_fd(0xc65b80)=7 12: btrfs_cow_block: root->fs_info->generation(0xc63568) = 5 trans->transid(0xc65b80)=7 13: ctree.c:368: btrfs_cow_block: Assertion `1` failed. ./btrfs-convert(btrfs_cow_block+0xda)[0x40ad37] ./btrfs-convert(btrfs_search_slot+0x1cb)[0x40c5b4] ./btrfs-convert(btrfs_insert_empty_items+0xac)[0x40d9f6] ./btrfs-convert(btrfs_record_file_extent+0xc0)[0x4183fe] ./btrfs-convert[0x435796] ./btrfs-convert[0x439b0c] ./btrfs-convert(main+0x13f8)[0x43b45d] /lib64/libc.so.6(__libc_start_main+0xfd)[0x335e01ecdd] ./btrfs-convert[0x407689] Conclusion: a: subthread should exit before step 5, but it is still running in step 11 b: task_stop() hadn't close periodic.timer_fd in step3, because periodic.timer_fd is not initialized yet. c. address of 0xc65b80 is overwrited by subthread in step 11, but this address is freed and re-malloc by main thread before step 10, and used for trans->transid. d: trans->transid which is overwrite by subthread caused error in step 13. Fix: pthread_cancel() only send a cancellation request to the thread, thread will quit in next cancellation point by default. To make sub thread quit in time, this patch add pthread_join() after pthread_cancel() call. And to make pthread_join() works, pthread_detach() is removed. Signed-off-by: Zhao Lei <zhaolei@cn.fujitsu.com> Signed-off-by: David Sterba <dsterba@suse.com>
2015-07-27 12:24:26 +00:00
pthread_join(info->id, NULL);
info->id = 0;
btrfs-progs: Fix wrong address accessing by subthread in btrfs-convert btrfs-convert sometimes show 'Assertion failed' in converting a nearly blank file system, as: create btrfs filesystem: blocksize: 4096 nodesize: 16384 features: extref, skinny-metadata (default) creating btrfs metadata. creating ext2fs image file. trans 7 running 5 ctree.c:363: btrfs_cow_block: Assertion `1` failed. btrfs-convert(btrfs_cow_block+0x92)[0x40acaf] btrfs-convert(btrfs_search_slot+0x1cb)[0x40c50f] btrfs-convert(btrfs_csum_file_block+0x20f)[0x41d83a] btrfs-convert[0x43422d] btrfs-convert[0x4342cd] btrfs-convert[0x4345ca] btrfs-convert[0x434767] btrfs-convert[0x435770] btrfs-convert[0x439748] btrfs-convert(main+0x13f8)[0x43b09d] /lib64/libc.so.6(__libc_start_main+0xfd)[0x335e01ecdd] btrfs-convert[0x407649] Reason is complex: 1: main thread allocated a block of memory, shared with sub thread 2: main thread killed sub thread, and free above memory 3: main thread malloc a new one(in same address), and use it 4: sub thread(which is not really quit), write into this address, and caused this bug. By adding some debug lines into code, we can see following output: create btrfs filesystem: blocksize: 4096 nodesize: 16384 features: extref, skinny-metadata (default) creating btrfs metadata. 1: ctx(0x7ffe1abde230)->info=0xc65b80 2: task_period_start: will create periodic.timer_fd 3: task_stop: info->periodic.timer_fd = NULL 4: task_stop: begin pthread_cancel info->id=-1746053376 5: task_stop: done pthread_cancel ret=0 6: task_stop: begin info->postfn 7: task_period_stop: periodic.timer_fd NULL 8: task_stop: done info->postfn 9: task_stop: done all 10: creating ext2fs image file. trans 7 running 5 11: task_period_start: create periodic.timer_fd done info->periodic.timer_fd(0xc65b80)=7 12: btrfs_cow_block: root->fs_info->generation(0xc63568) = 5 trans->transid(0xc65b80)=7 13: ctree.c:368: btrfs_cow_block: Assertion `1` failed. ./btrfs-convert(btrfs_cow_block+0xda)[0x40ad37] ./btrfs-convert(btrfs_search_slot+0x1cb)[0x40c5b4] ./btrfs-convert(btrfs_insert_empty_items+0xac)[0x40d9f6] ./btrfs-convert(btrfs_record_file_extent+0xc0)[0x4183fe] ./btrfs-convert[0x435796] ./btrfs-convert[0x439b0c] ./btrfs-convert(main+0x13f8)[0x43b45d] /lib64/libc.so.6(__libc_start_main+0xfd)[0x335e01ecdd] ./btrfs-convert[0x407689] Conclusion: a: subthread should exit before step 5, but it is still running in step 11 b: task_stop() hadn't close periodic.timer_fd in step3, because periodic.timer_fd is not initialized yet. c. address of 0xc65b80 is overwrited by subthread in step 11, but this address is freed and re-malloc by main thread before step 10, and used for trans->transid. d: trans->transid which is overwrite by subthread caused error in step 13. Fix: pthread_cancel() only send a cancellation request to the thread, thread will quit in next cancellation point by default. To make sub thread quit in time, this patch add pthread_join() after pthread_cancel() call. And to make pthread_join() works, pthread_detach() is removed. Signed-off-by: Zhao Lei <zhaolei@cn.fujitsu.com> Signed-off-by: David Sterba <dsterba@suse.com>
2015-07-27 12:24:26 +00:00
}
if (info->periodic.timer_fd) {
close(info->periodic.timer_fd);
info->periodic.timer_fd = 0;
}
if (info->postfn)
info->postfn(info->private_data);
}
void task_deinit(struct task_info *info)
{
if (!info)
return;
free(info);
}
int task_period_start(struct task_info *info, unsigned int period_ms)
{
unsigned int ns;
unsigned int sec;
struct itimerspec itval;
if (!info)
return -1;
info->periodic.timer_fd = timerfd_create(CLOCK_MONOTONIC, 0);
if (info->periodic.timer_fd == -1) {
info->periodic.timer_fd = 0;
return info->periodic.timer_fd;
}
info->periodic.wakeups_missed = 0;
sec = period_ms / 1000;
ns = (period_ms - (sec * 1000)) * 1000;
itval.it_interval.tv_sec = sec;
itval.it_interval.tv_nsec = ns;
itval.it_value.tv_sec = sec;
itval.it_value.tv_nsec = ns;
return timerfd_settime(info->periodic.timer_fd, 0, &itval, NULL);
};
void task_period_wait(struct task_info *info)
{
unsigned long long missed;
int ret;
if (!info)
return;
if (info->periodic.timer_fd == 0)
return;
ret = read(info->periodic.timer_fd, &missed, sizeof (missed));
if (ret == -1)
return;
if (missed > 0)
info->periodic.wakeups_missed += (missed - 1);
}
void task_period_stop(struct task_info *info)
{
if (!info)
return;
if (info->periodic.timer_fd) {
timerfd_settime(info->periodic.timer_fd, 0, NULL, NULL);
close(info->periodic.timer_fd);
info->periodic.timer_fd = -1;
}
}