From 57caacb0c123549fd87643753db1d932f675bf45 Mon Sep 17 00:00:00 2001 From: Mike Marshall Date: Mon, 14 Sep 2026 14:15:56 -0400 Subject: [PATCH 1/3] orangefs: use ssize_t instead of size_t for error codes... strscpy can return size or errno. Signed-off-by: Mike Marshall Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604071606.asPgJ8Fk-lkp@intel.com/ --- fs/orangefs/orangefs-debugfs.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 9f94919a6bc6..fec7c1e864d2 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -238,7 +238,7 @@ void orangefs_debugfs_init(int debug_mask) static void orangefs_kernel_debug_init(void) { static char k_buffer[ORANGEFS_MAX_DEBUG_STRING_LEN] = { }; - size_t len = + ssize_t len = strscpy(k_buffer, kernel_debug_string, sizeof(k_buffer) - 1); if (len > 0) { @@ -246,7 +246,8 @@ static void orangefs_kernel_debug_init(void) k_buffer[len + 1] = '\0'; } else { strscpy(k_buffer, "none\n"); - pr_info("%s: overflow 1!\n", __func__); + if (len <0) + pr_info("%s: overflow 1!\n", __func__); } debugfs_create_file_aux_num(ORANGEFS_KMOD_DEBUG_FILE, 0444, debug_dir, k_buffer, @@ -337,7 +338,7 @@ static int help_show(struct seq_file *m, void *v) static void orangefs_client_debug_init(void) { static char c_buffer[ORANGEFS_MAX_DEBUG_STRING_LEN] = { }; - size_t len = + ssize_t len = strscpy(c_buffer, client_debug_string, sizeof(c_buffer) - 1); if (len > 0) { @@ -345,7 +346,8 @@ static void orangefs_client_debug_init(void) c_buffer[len + 1] = '\0'; } else { strscpy(c_buffer, "none\n"); - pr_info("%s: overflow! 2\n", __func__); + if (len <0) + pr_info("%s: overflow! 2\n", __func__); } client_debug_dentry = debugfs_create_file_aux_num( From cb90176836500d72a592c4b7877c18c91275a341 Mon Sep 17 00:00:00 2001 From: Mike Marshall Date: Mon, 24 Aug 2026 15:00:35 -0400 Subject: [PATCH 2/3] orangefs_super: don't wait on service operation on system shutdown. If someone reboots the system while an orangefs filesystem is still mounted, don't wait for the completion of an unmount service operation that's never going to return. Signed-off-by: Mike Marshall --- fs/orangefs/super.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c index 4ec7329b41f6..e6eedb2faef7 100644 --- a/fs/orangefs/super.c +++ b/fs/orangefs/super.c @@ -383,6 +383,24 @@ static int orangefs_unmount(int id, __s32 fs_id, const char *devname) { struct orangefs_kernel_op_s *op; int r; + + /* + * If someone reboots linux without unmounting orangefs first, + * don't bother firing off an unmount service operation that + * will never complete, or the whole system shutdown + * stalls for ORANGEFS_DEFAULT_OP_TIMEOUT_SECS. + */ + + if (!__is_daemon_in_service() || + system_state == SYSTEM_HALT || + system_state == SYSTEM_POWER_OFF || + system_state == SYSTEM_RESTART) { + gossip_debug(GOSSIP_SUPER_DEBUG, + "%s: dirty unmount.\n", + __func__); + return 0; + } + op = op_alloc(ORANGEFS_VFS_OP_FS_UMOUNT); if (!op) return -ENOMEM; From 2bc09cb0e9e44c7e622b956332ebfb9b638fd5f7 Mon Sep 17 00:00:00 2001 From: Mike Marshall Date: Mon, 7 Sep 2026 12:02:40 -0400 Subject: [PATCH 3/3] orangefs: don't continue on to gpf if client dies on write. I got a message from Farhad Alemi (farhad.alemi@berkeley.edu) showing that this can happen: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:orangefs_writepages_callback fs/orangefs/inode.c:144 [inline] RIP: 0010:orangefs_writepages+0x642/0xc60 fs/orangefs/inode.c:205 Call Trace: orangefs_writepages+0x642/0xc60 fs/orangefs/inode.c:205 do_writepages+0x328/0x550 mm/page-writeback.c:2571 filemap_write_and_wait_range+0x332/0x3f0 mm/filemap.c:685 orangefs_flush+0x44/0x60 fs/orangefs/file.c:566 filp_flush+0xbd/0x190 fs/open.c:1467 filp_close+0x1d/0x40 fs/open.c:1480 close_files fs/file.c:494 [inline] put_files_struct+0x1b6/0x340 fs/file.c:509 do_exit+0x6a8/0x2360 kernel/exit.c:971 With the help of Grok I created a reproducer program that causes a gpf on the same line: "ow->folios[ow->nfolios++] = folio;" in orangefs_writepages_callback. The reproducer program flows into this new code after this patch. Signed-off-by: Mike Marshall --- fs/orangefs/inode.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c index cd3273c88e03..c088a02e8215 100644 --- a/fs/orangefs/inode.c +++ b/fs/orangefs/inode.c @@ -181,8 +181,27 @@ static int orangefs_writepages(struct address_space *mapping, { struct orangefs_writepages *ow; struct blk_plug plug; - int error; + int error = 0; struct folio *folio = NULL; + int maxpages; + + maxpages = orangefs_bufmap_size_query() / PAGE_SIZE; + if (maxpages < 1) { + /* + * Probably the client is dead and there's no bufmap. + * Walk writeback_iter anyway so each dirty folio is unlocked + * and writeback is ended. wait_for_direct_io will fail; the + * data is not written. + */ + gossip_err("%s: maxpages < 1. \n", __func__); + while ((folio = writeback_iter(mapping, wbc, folio, &error))) { + error = orangefs_writepage_locked(folio, wbc); + mapping_set_error(mapping, error); + folio_unlock(folio); + folio_end_writeback(folio); + } + return error; + } ow = kzalloc_obj(struct orangefs_writepages); if (!ow)