FAILED: patch "[PATCH] btrfs: do not call synchronize_srcu() in inode_tree_del" failed to apply to 4.9-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f72ff01df9cf5db25c76674cac16605992d15467 Mon Sep 17 00:00:00 2001
From: Josef Bacik <[email protected]>
Date: Tue, 19 Nov 2019 13:59:35 -0500
Subject: [PATCH] btrfs: do not call synchronize_srcu() in inode_tree_del
Testing with the new fsstress uncovered a pretty nasty deadlock with lookup and snapshot deletion.
Process A
unlink
-> final iput
-> inode_tree_del
-> synchronize_srcu(subvol_srcu)
Process Bbtrfs_lookup <- srcu_read_lock() acquired here
-> btrfs_iget
-> find inode that has I_FREEING set
-> __wait_on_freeing_inode()We're holding the srcu_read_lock() while doing the iget in order to make sure our fs root doesn't go away, and then we are waiting for the inode to finish freeing. However because the free'ing process is doing a synchronize_srcu() we deadlock.
Fix this by dropping the synchronize_srcu() in inode_tree_del(). We don't need people to stop accessing the fs root at this point, we're only adding our empty root to the dead roots list.
A larger much more invasive fix is forthcoming to address how we deal with fs roots, but this fixes the immediate problem.
fs/btrfs/inode.c +0 -2
@@ -5728,7 +5728,6 @@ static void inode_tree_add(struct inode *inode)static void inode_tree_del (struct inode *inode) { -struct btrfs_fs_info *fs_info =btrfs_sb (inode->i_sb);struct btrfs_root *root =BTRFS_I (inode)->root;int empty =0 ;
@@ -5741,7 +5740,6 @@ static void inode_tree_del(struct inode *inode)spin_unlock (&root->inode_lock);if (empty &&btrfs_root_refs (&root->root_item) ==0 ) { -synchronize_srcu (&fs_info->subvol_srcu);spin_lock (&root->inode_lock); empty =RB_EMPTY_ROOT (&root->inode_tree);spin_unlock (&root->inode_lock);
Sasha Levin
maintainerQuoted 41 lines · On Mon, Dec 23, 2019 at 12:11:47PM -0500, [email protected] wrote:
The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From
f72ff01df9cf5db25c76674cac16605992d15467Mon Sep 17 00:00:00 2001
From: Josef Bacik <[email protected]>
Date: Tue, 19 Nov 2019 13:59:35 -0500
Subject: [PATCH] btrfs: do not callsynchronize_srcu()ininode_tree_delTesting with the new fsstress uncovered a pretty nasty deadlock with lookup and snapshot deletion.
Process A
unlink
-> final iput
->inode_tree_del-> synchronize_srcu(subvol_srcu)Process B
btrfs_lookup<-srcu_read_lock()acquired here
->btrfs_iget
-> find inode that hasI_FREEINGset-> __wait_on_freeing_inode()We're holding the
srcu_read_lock()while doing the iget in order to make sure our fs root doesn't go away, and then we are waiting for the inode to finish freeing. However because the free'ing process is doing asynchronize_srcu()we deadlock.Fix this by dropping the
synchronize_srcu()ininode_tree_del(). We don't need people to stop accessing the fs root at this point, we're only adding our empty root to the dead roots list.
Quoted 8 lines
A larger much more invasive fix is forthcoming to address how we deal with fs roots, but this fixes the immediate problem.
Fixes 76dda93c6ae2 ("Btrfs: add snapshot/subvolume destroy ioctl")CC [email protected] # 4.4+Signed-off-by Josef Bacik <[email protected]>Reviewed-by David Sterba <[email protected]>Signed-off-by David Sterba <[email protected]>
Fixed up to work around missing 0b246afa62b0 ("btrfs: root->fs_info cleanup, add fs_info convenience variables") and queued for 4.9 and 4.4.
Signature · 2 lines
Thanks, Sasha