[PATCH v3] f2fs: reserve space to be shrunk during resize_fs

[Daeho Jeong <daeho43@gmail.com>]

From: Daeho Jeong <daehojeong@google.com>

f2fs_resize_fs() drops gc_lock and the cp lock between the free space
check and freeze_super(). In that window, others can allocate the free
space, so the second check after freeze_super() fails with -ENOSPC.
This is easy to hit on a busy filesystem, e.g. at OTA install time.

Reserve the space to be shrunk via resize_reserved_blocks once the
first check passes, and deduct it in __get_available_block_count() like
alias_reserved_blocks. Release it on success or on error.

With the reservation, the second check should not fail anymore, so:
- allow root reserved blocks, which root may use in the meantime,
- recheck DISABLE_CHECKPOINT, which remount may set in the meantime,
  since freeze_super() fails only when the fs is still dirty,
- keep the check only as a WARN_ON_ONCE() safety net.

Also exclude the alias/resize reservations when updating
current_reserved_blocks via sysfs. Otherwise, the reserved blocks can
take the space which is already reserved, and the second check fails.

Suggested-by: Chao Yu <chao@kernel.org>
Signed-off-by: Daeho Jeong <daehojeong@google.com>
---
This patch depends on "f2fs: avoid underflow in
get_available_block_count()", which is sent separately.

v2: https://lore.kernel.org/linux-f2fs-devel/20261022165526.1539629-1-daeho43@gmail.com/

Changes in v3:
- Rebase on top of the patch above. In the case from the v2 review
  (user_block_count = 1000, root_reserved_blocks = 100, valid = 30, resize
  reserves 500, then 500 is written to reserved_blocks),
  current_reserved_blocks becomes 470. The reservations add up to 1070 for
  a user who cannot use the root reserved blocks, so that user gets 0
  instead of a wrapped value. Root gets 30, which equals the valid blocks,
  so the second check still passes.
- Update the comment in the sysfs hunk: the reservations are excluded so
  that the second check does not fail, not to avoid the underflow.
- Rebase onto the latest dev-test.

Changes in v2:
- Exclude alias/resize reservations from current_reserved_blocks.
- Allow root reserved blocks in the second check, with WARN_ON_ONCE().
- Recheck DISABLE_CHECKPOINT after freeze_super().

 fs/f2fs/f2fs.h  | 19 +++++++++++++----
 fs/f2fs/gc.c    | 54 ++++++++++++++++++++++++++++++++++++++-----------
 fs/f2fs/super.c |  1 +
 fs/f2fs/sysfs.c | 11 +++++++++-
 4 files changed, 68 insertions(+), 17 deletions(-)

diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 59bc3c2fb70a..d9cf2d4fae21 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1920,6 +1920,7 @@ struct f2fs_sb_info {
 	block_t reserved_blocks;		/* configurable reserved blocks */
 	block_t current_reserved_blocks;	/* current reserved blocks */
 	block_t alias_reserved_blocks;		/* reserved blocks for device alias */
+	block_t resize_reserved_blocks;		/* reserved blocks for resize_fs */
 
 	/* Additional tracking for no checkpoint mode */
 	block_t unusable_block_count;		/* # of blocks saved by last cp */
@@ -2707,13 +2708,14 @@ static inline bool __allow_reserved_root(struct f2fs_sb_info *sbi,
 	return false;
 }
 
-static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
-						struct inode *inode, bool cap)
+static inline unsigned int __get_available_block_count(struct f2fs_sb_info *sbi,
+						       bool allow_root)
 {
 	u64 reserved = (u64)sbi->current_reserved_blocks +
-					sbi->alias_reserved_blocks;
+					sbi->alias_reserved_blocks +
+					sbi->resize_reserved_blocks;
 
-	if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_root(sbi, inode, cap))
+	if (test_opt(sbi, RESERVE_ROOT) && !allow_root)
 		reserved += F2FS_OPTION(sbi).root_reserved_blocks;
 
 	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED)))
@@ -2726,6 +2728,15 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
 	return sbi->user_block_count - reserved;
 }
 
+static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
+						     struct inode *inode,
+						     bool cap)
+{
+	bool allow_root = __allow_reserved_root(sbi, inode, cap);
+
+	return __get_available_block_count(sbi, allow_root);
+}
+
 static inline void f2fs_i_blocks_write(struct inode *, block_t, bool, bool);
 static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
 				 struct inode *inode, blkcnt_t *count,
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index 337ecf4df945..7609c23ec27b 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -2420,6 +2420,7 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count)
 	struct f2fs_lock_context glc;
 	struct f2fs_lock_context clc;
 	unsigned int secs, old_tail;
+	bool reserved = false;
 	int err = 0;
 	__u32 rem;
 
@@ -2471,10 +2472,17 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count)
 	f2fs_lock_op(sbi, &lc);
 
 	spin_lock(&sbi->stat_lock);
-	if (shrunk_blocks + valid_user_blocks(sbi) +
-		sbi->current_reserved_blocks + sbi->unusable_block_count +
-		F2FS_OPTION(sbi).root_reserved_blocks > sbi->user_block_count)
+	if (shrunk_blocks + valid_user_blocks(sbi) >
+			__get_available_block_count(sbi, false)) {
 		err = -ENOSPC;
+	} else {
+		/*
+		 * Reserve the space to be shrunk so that no one, including
+		 * root, can allocate it until the shrink is done.
+		 */
+		sbi->resize_reserved_blocks += shrunk_blocks;
+		reserved = true;
+	}
 	spin_unlock(&sbi->stat_lock);
 
 	if (err)
@@ -2488,29 +2496,45 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count)
 out_drop_write:
 	mnt_drop_write_file(filp);
 	if (err)
-		return err;
+		goto out_release;
 
 	err = freeze_super(sbi->sb, FREEZE_HOLDER_KERNEL, NULL);
 	if (err)
-		return err;
+		goto out_release;
 
 	if (f2fs_readonly(sbi->sb)) {
 		err = thaw_super(sbi->sb, FREEZE_HOLDER_KERNEL, NULL);
-		if (err)
-			return err;
-		return -EROFS;
+		if (!err)
+			err = -EROFS;
+		goto out_release;
+	}
+
+	/* checkpoint can be disabled by remount before freeze_super() */
+	if (test_opt(sbi, DISABLE_CHECKPOINT)) {
+		f2fs_err(sbi, "Checkpoint should be enabled.");
+		err = thaw_super(sbi->sb, FREEZE_HOLDER_KERNEL, NULL);
+		if (!err)
+			err = -EINVAL;
+		goto out_release;
 	}
 
 	f2fs_down_write_trace(&sbi->gc_lock, &glc);
 	f2fs_down_write_trace(&sbi->cp_global_sem, &clc);
 
 	spin_lock(&sbi->stat_lock);
-	if (shrunk_blocks + valid_user_blocks(sbi) +
-		sbi->current_reserved_blocks + sbi->unusable_block_count +
-		F2FS_OPTION(sbi).root_reserved_blocks > sbi->user_block_count)
+	/*
+	 * shrunk_blocks is already accounted in resize_reserved_blocks, so
+	 * this should not fail. Allow root reserved blocks here since root
+	 * may have used them after the first check, regardless of resize.
+	 */
+	if (WARN_ON_ONCE(valid_user_blocks(sbi) >
+			__get_available_block_count(sbi, true))) {
 		err = -ENOSPC;
-	else
+	} else {
 		sbi->user_block_count -= shrunk_blocks;
+		sbi->resize_reserved_blocks -= shrunk_blocks;
+		reserved = false;
+	}
 	spin_unlock(&sbi->stat_lock);
 	if (err)
 		goto out_err;
@@ -2559,5 +2583,11 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count)
 	f2fs_up_write_trace(&sbi->cp_global_sem, &clc);
 	f2fs_up_write_trace(&sbi->gc_lock, &glc);
 	thaw_super(sbi->sb, FREEZE_HOLDER_KERNEL, NULL);
+out_release:
+	if (reserved) {
+		spin_lock(&sbi->stat_lock);
+		sbi->resize_reserved_blocks -= shrunk_blocks;
+		spin_unlock(&sbi->stat_lock);
+	}
 	return err;
 }
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 78dbf1e92285..f5966ae2d11b 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -5414,6 +5414,7 @@ static int f2fs_fill_super(struct super_block *sb, struct fs_context *fc)
 	sbi->reserved_blocks = 0;
 	sbi->current_reserved_blocks = 0;
 	sbi->alias_reserved_blocks = 0;
+	sbi->resize_reserved_blocks = 0;
 	limit_reserve_root(sbi);
 	adjust_unusable_cap_perc(sbi);
 
diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
index 430356e500af..8ab9a5098f1c 100644
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -594,6 +594,8 @@ static ssize_t __sbi_store(struct f2fs_attr *a,
 	}
 #endif
 	if (a->struct_type == RESERVED_BLOCKS) {
+		block_t avail, valid;
+
 		spin_lock(&sbi->stat_lock);
 		if (t > (unsigned long)(sbi->user_block_count -
 				F2FS_OPTION(sbi).root_reserved_blocks)) {
@@ -601,8 +603,15 @@ static ssize_t __sbi_store(struct f2fs_attr *a,
 			return -EINVAL;
 		}
 		*ui = t;
+		/*
+		 * Exclude the space reserved for device aliasing and resize_fs,
+		 * otherwise the reserved blocks can take it and make them fail.
+		 */
+		avail = sbi->user_block_count - sbi->alias_reserved_blocks -
+					sbi->resize_reserved_blocks;
+		valid = valid_user_blocks(sbi);
 		sbi->current_reserved_blocks = min(sbi->reserved_blocks,
-				sbi->user_block_count - valid_user_blocks(sbi));
+				avail > valid ? avail - valid : 0);
 		spin_unlock(&sbi->stat_lock);
 		return count;
 	}

base-commit: b9d7379d10d43386b59082da8c9a0b111e054781
prerequisite-patch-id: 5b947a4267506336d2083e4b20686c7c39a4233e
-- 
2.56.0.611.g1030f0b940-goog