发现了一个 btrfs 的 bug，有没有 v 友一起来看下？

我让 Codex 帮我写了一个可以稳定触发这个 bug 的程序： #define _GNU_SOURCE #include <errno.h> #include <fcntl.h> #include <pthread.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <stdatomic.h> #include <sys/mman.h> #include <unistd.h> #define READ_SIZE 4096UL #define TEST_FILE_SIZE (1UL * 1024 * 1024) #define MAX_TRIES 100UL /* * Reproduce the Btrfs direct-IO checksum false failure: * one thread overwrites the O_DIRECT read buffer while read() is in flight. */ static atomic_int stop_scribble; static void fill_buffer(char *buf, size_t len, uint64_t *seed) { size_t i; for (i = 0; i < len; i++) { *seed ^= *seed << 13; *seed ^= *seed >> 7; *seed ^= *seed << 17; buf[i] = (char)*seed; } } static int create_test_file(void) { char path[] = "./btrfs-read-repro.XXXXXX"; char buf[READ_SIZE]; uint64_t seed = 0x123456789abcdef0ULL; size_t done; int fd; int direct_fd; fd = mkstemp(path); if (fd < 0) { perror("mkstemp"); return -1; } for (done = 0; done < TEST_FILE_SIZE; done += sizeof(buf)) { ssize_t ret; fill_buffer(buf, sizeof(buf), &seed); ret = write(fd, buf, sizeof(buf)); if (ret != (ssize_t)sizeof(buf)) { if (ret < 0) { perror("write"); } else { fprintf(stderr, "short write: %zd\n", ret); } goto fail; } } if (fsync(fd) < 0) { perror("fsync"); goto fail; } (void)posix_fadvise(fd, 0, 0, POSIX_FADV_DONTNEED); close(fd); direct_fd = open(path, O_RDONLY | O_DIRECT | O_CLOEXEC); if (direct_fd < 0) { perror(path); unlink(path); return -1; } unlink(path); return direct_fd; fail: close(fd); unlink(path); return -1; } static void *scribble_thread(void *opaque) { char *buf = opaque; uint64_t v = 0x5a5a5a5a5a5a5a5aULL; while (!atomic_load_explicit(&stop_scribble, memory_order_relaxed)) { size_t off; for (off = 0; off < READ_SIZE; off += sizeof(v)) { *(volatile uint64_t *)(buf + off) = v; } v += 0x0101010101010101ULL; } return NULL; } int main(void) { pthread_t scribbler; char *buf; int fd; int reproduced = 0; fd = create_test_file(); if (fd < 0) { return 1; } buf = mmap(NULL, READ_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (buf == MAP_FAILED) { perror("mmap"); close(fd); return 1; } if (pthread_create(&scribbler, NULL, scribble_thread, buf) != 0) { perror("pthread_create"); munmap(buf, READ_SIZE); close(fd); return 1; } for (unsigned long n = 0; n < MAX_TRIES; n++) { ssize_t ret; if (lseek(fd, 0, SEEK_SET) < 0) { perror("lseek"); break; } ret = read(fd, buf, READ_SIZE); if (ret < 0 && errno == EIO) { fprintf(stderr, "reproduced: read returned EIO at try %lu\n", n); reproduced = 1; break; } if (ret != (ssize_t)READ_SIZE) { fprintf(stderr, "unexpected read result: %zd errno=%d\n", ret, errno); break; } } atomic_store_explicit(&stop_scribble, 1, memory_order_relaxed); pthread_join(scribbler, NULL); munmap(buf, READ_SIZE); close(fd); if (!reproduced) { fprintf(stderr, "not reproduced after %lu tries\n", MAX_TRIES); return 1; } return 0; } 只需要当前目录是 btrfs ，运行这个程序就能直接触发下面这个报错： root@develop:~/test# gcc btrfs_read_repro.c -pthread -o btrfs_read_repro root@develop:~/test# root@develop:~/test# ./btrfs_read_repro reproduced: read returned EIO at try 1 root@develop:~/test# root@develop:~/test# dmesg [12297.261256] BTRFS warning (device nvme1n1p1): csum failed root 336 ino 1110132 off 0 csum 0x588c3802 expected csum 0x84efe040 mirror 1 [12297.261263] BTRFS error (device nvme1n1p1): bdev /dev/nvme1n1p1 errs: wr 0, rd 0, flush 0, corrupt 36926, gen 0 [12297.261267] BTRFS warning (device nvme1n1p1): direct IO failed ino 1110132 op 0x8800 offset 0x0 len 4096 err no 10 root@develop:~/test# 我用最新的 7.3-rc1 内核测试仍然有这个报错，不知道上游是否知道有这个 bug ，这个 bug 用 5.10 内核都能复现，如果上游知道这个 bug 的存在为啥到现在还都没有修复。