From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792774128; b=pcKG4rorbDhL/kSdQT2Cfl4WEXRu8q0QbqjxbvbZ8n3plezFOWR8ud8XlAX2nF/ludmq omnfVMleOSK9FsAlBzqAXp2pyjgd5foFVkTzdbkd+nW/KHUpwIZo6j41xW/AhpsYpamFF dmswan6bcH7qnVPCUYG/8wpleraWXiUFed/RnCA4bBA+oiEKvNPnu1Mp6QnghnkFN1Zp2 qGVqqamxe+VSMoKFFWDOU1HiwrD9qqtt3oXg7w1yoGa7RBkZ3PjOmL/Zwq2vlHy2cqE0I LRnyRQgmZJx1S0gWCgzFomuIDWCJQQcJvfIGkM+QnI2ebP1JFDQbpdgGPKpqWlH14lg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792774128; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=onuvY692Ep5M7CA3leO84jjNNt7Jzz0tPrBY57biz2c=; b=f6vbYI+Y2P6BEyLi8H6ocpZ6DyJj3cxlmGlCgb2DvGR9SSBSBP5hlM/TdK5+LyzlUAfp r/9VmiFqmKCE9cqsK6Xn2twQLZVB1eVYAaRXZY/J2YZRGkjQtC/Iu5QGxHpdOacgnXN1y oPIssKwalrNvbVX1VeOZscUT1W97amq0Zxcz01Ob4us1EMCw5nTG8gf+Rsh1xzOy7V9h9 BbC+fqVkZVYeWltGs6KV4WAmWEgGy6yFYUErorrmHS5xV7C4kMx5kea5/zC6YRNN8LtM7 3bGcG6oZ3CxozmGpn1nCk06L8UvtlCjgYBXyvkcvLXjt0UqqYz7XlpPnHvGnXbkmQBQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=wcXFkW3r; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27C18606A31A; Fri, 23 Oct 2026 16:48:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=wcXFkW3r Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D62D1F031E0; Fri, 23 Oct 2026 16:48:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792774127; bh=onuvY692Ep5M7CA3leO84jjNNt7Jzz0tPrBY57biz2c=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wcXFkW3rnCk8JWctsCBwe08KpXK2QHZeSR190nnASRdPIUM707sL1CAsWejgsosyD uC2Pc8d9DIySxONCgQE3jwvWvLWBuKYm4f6xKp6tkGBYpzlx2HKURovAx2MMZxBcQ8 cSi8il7lYaP7504OyKGhGTvjjvlM/huJKORAFiqg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+837bcd54843dd6262f2f@syzkaller.appspotmail.com, Yun Zhou , Christoph Hellwig , Carlos Maiolino Subject: [PATCH 6.18 129/193] xfs: dont hold buffer locks across sync transaction commit in xfs_sync_sb_buf Date: Fri, 23 Oct 2026 18:36:46 +0200 Message-ID: <20261023163717.260218209@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261023163714.201276352@linuxfoundation.org> References: <20261023163714.201276352@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yun Zhou commit 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff upstream. xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to lock these buffers to fail them, causing a deadlock: setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf) Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback. Fixes: f7664b31975b ("xfs: implement online get/set fs label") Reported-by: syzbot+837bcd54843dd6262f2f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=837bcd54843dd6262f2f Cc: stable@vger.kernel.org Signed-off-by: Yun Zhou Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino Signed-off-by: Greg Kroah-Hartman --- fs/xfs/libxfs/xfs_rtgroup.h | 6 +++++- fs/xfs/libxfs/xfs_sb.c | 37 +++++++++++++++++-------------------- 2 files changed, 22 insertions(+), 21 deletions(-) --- a/fs/xfs/libxfs/xfs_rtgroup.h +++ b/fs/xfs/libxfs/xfs_rtgroup.h @@ -367,7 +367,11 @@ static inline int xfs_initialize_rtgroup # define xfs_rtgroup_unlock(rtg, gf) ((void)0) # define xfs_rtgroup_trans_join(tp, rtg, gf) ((void)0) # define xfs_update_rtsb(bp, sb_bp) ((void)0) -# define xfs_log_rtsb(tp, sb_bp) (NULL) +static inline struct xfs_buf *xfs_log_rtsb(struct xfs_trans *tp, + const struct xfs_buf *sb_bp) +{ + return NULL; +} # define xfs_rtgroup_get_geometry(rtg, rgeo) (-EOPNOTSUPP) #endif /* CONFIG_XFS_RT */ --- a/fs/xfs/libxfs/xfs_sb.c +++ b/fs/xfs/libxfs/xfs_sb.c @@ -1467,36 +1467,33 @@ xfs_sync_sb_buf( bool update_rtsb) { struct xfs_trans *tp; - struct xfs_buf *bp; - struct xfs_buf *rtsb_bp = NULL; int error; error = xfs_trans_alloc(mp, &M_RES(mp)->tr_sb, 0, 0, 0, &tp); if (error) return error; - bp = xfs_trans_getsb(tp); xfs_log_sb(tp); - xfs_trans_bhold(tp, bp); - if (update_rtsb) { - rtsb_bp = xfs_log_rtsb(tp, bp); - if (rtsb_bp) - xfs_trans_bhold(tp, rtsb_bp); - } + if (update_rtsb) + xfs_log_rtsb(tp, xfs_trans_getsb(tp)); xfs_trans_set_sync(tp); error = xfs_trans_commit(tp); if (error) - goto out; - /* - * write out the sb buffer to get the changes to disk - */ - error = xfs_bwrite(bp); - if (!error && rtsb_bp) - error = xfs_bwrite(rtsb_bp); -out: - if (rtsb_bp) - xfs_buf_relse(rtsb_bp); - xfs_buf_relse(bp); + return error; + + /* Re-acquire and write the sb and rtsb to disk. */ + xfs_buf_lock(mp->m_sb_bp); + error = xfs_bwrite(mp->m_sb_bp); + xfs_buf_unlock(mp->m_sb_bp); + if (error) + return error; + + if (update_rtsb && mp->m_rtsb_bp) { + xfs_buf_lock(mp->m_rtsb_bp); + error = xfs_bwrite(mp->m_rtsb_bp); + xfs_buf_unlock(mp->m_rtsb_bp); + } + return error; }