Bug 22452 - data corruption after mmap()ing a file and writev() some data to another file
Summary: data corruption after mmap()ing a file and writev() some data to another file
Status: CLOSED CODE_FIX
Alias: None
Product: File System
Classification: Unclassified
Component: XFS (show other bugs)
Hardware: All Linux
: P1 high
Assignee: XFS Guru
URL:
Keywords:
Depends on:
Blocks: 16444
  Show dependency tree
 
Reported: 2010-11-08 10:33 UTC by Marius Tolzmann
Modified: 2010-12-05 19:57 UTC (History)
6 users (show)

See Also:
Kernel Version: 2.6.36
Subsystem:
Regression: Yes
Bisected commit-id:


Attachments
map-test.c mmap() a file and writev() back to another file (826 bytes, text/plain)
2010-11-08 10:33 UTC, Marius Tolzmann
Details
Handle delalloc truncation during failed writes without xfs_setattr (3.84 KB, patch)
2010-11-09 00:26 UTC, Christoph Hellwig
Details | Diff
map-test.c mmap() a file and writev() back to another file (1.64 KB, text/plain)
2010-11-09 09:10 UTC, Marius Tolzmann
Details
gplv2+ version: map-test.c mmap() a file and writev() back to another file (1.71 KB, text/plain)
2010-11-09 11:03 UTC, Marius Tolzmann
Details
wtfpl version: map-test.c mmap() a file and writev() back to another file (1.22 KB, text/plain)
2010-11-09 11:19 UTC, Marius Tolzmann
Details

Description Marius Tolzmann 2010-11-08 10:33:55 UTC
Created attachment 36732 [details]
map-test.c mmap() a file and writev() back to another file

Hi there,

we experienced some serious database corruptions in cyrus imap after switching to the latest stable kernel (2.6.36).

we traced this down to some mmap()ing and writev() afterwards. 

Donald Buczek wrote a small test-program to reproduce this (.c-file attached)

to reproduce the corruption please compile map-test.c and run:

  echo -n "cccccccccc">test.flat
  ./map-test
  xxd test.flat.NEW

how we built the xfs and mounted it:
  mkfs.xfs /dev/sda3
  mount /dev/sda3 /mnt

example output under XFS: (/dev/sda3 /mnt xfs rw,relatime,attr2,noquota)
0000000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000010: 0000 0000 6363 6363 6363 6363 6363       ....cccccccccc

example output under reiserfs:
0000000: 6161 6161 6161 6161 6161 6262 6262 6262  aaaaaaaaaabbbbbb
0000010: 6262 6262 6363 6363 6363 6363 6363       bbbbcccccccccc

please let me know what else to provide to make reproducing this bug easier..

we downgraded to linux 2.6.35.8 and everything seems to be fine again.

regards, 
   marius tolzmann
Comment 1 Christoph Hellwig 2010-11-08 11:56:05 UTC
Verified.  Ext2 shows the same problems so it seems like a generic problem with the new truncate sequence.
Comment 2 Christoph Hellwig 2010-11-09 00:26:06 UTC
Created attachment 36842 [details]
Handle delalloc truncation during failed writes without xfs_setattr

This is a patch that fixes your testcase by not using xfs_setattr for truncating delalloc blocks on a failed write, but rather doing it manually.  It does pass xfstests for me, but probably isn't the final version yet.  I'll move additional discussion on it to the mailinglist.

Btw, can you license your testcase under GPLv2 or any less restrictive license?  We'd like to include it in the xfstests regression test suite.
Comment 3 Marius Tolzmann 2010-11-09 09:10:59 UTC
Created attachment 36892 [details]
 map-test.c mmap() a file and writev() back to another file

now including the gpl header to make it possible to include it in the xfstests regression test suite. 8)

regards,
    marius tolzmann
Comment 4 Marius Tolzmann 2010-11-09 10:23:35 UTC
thanks for fixing it.. 

since ext2 seems to show a similar problem how is the "normal" way to somehow clone this bug or refile it to their list? - we don't use ext[234] here so i can't run the testcase on ext2.
Comment 5 Christoph Hellwig 2010-11-09 10:48:43 UTC
Any chance you could relicense it under GPLv2/GPLVv2+ or similar?  The GPLv3 is unfortunately more restrictive than the rest of xfstests.
Comment 6 Christoph Hellwig 2010-11-09 10:51:24 UTC
(In reply to comment #4)
> since ext2 seems to show a similar problem how is the "normal" way to somehow
> clone this bug or refile it to their list? - we don't use ext[234] here so i
> can't run the testcase on ext2.

Sorry, ext2 isn't affected in the end, I just tested the wrong partition. The only other likely suspect, gfs2 doesn't seem to be affected either.
Comment 7 Marius Tolzmann 2010-11-09 11:03:25 UTC
Created attachment 36932 [details]
gplv2+ version: map-test.c mmap() a file and writev() back to another file

so now GPLv2+..  ;)
Comment 8 Marius Tolzmann 2010-11-09 11:19:54 UTC
Created attachment 36942 [details]
wtfpl version: map-test.c mmap() a file and writev() back to another file

alternativly licensed it under the WTFPL ;)
Comment 9 Florian Mickler 2010-11-16 18:59:38 UTC
Patch: http://www.spinics.net/lists/xfs/msg02126.html
Comment 10 Rafael J. Wysocki 2010-12-05 19:57:40 UTC
Fixed by commit c726de4 xfs: fix failed write truncation handling.

Note You need to log in before you can comment on or make changes to this bug.