Re: [PATCH RFC v3 10/14] ext2: drop mmb_sync() from ext2_evict_inode()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] ext2: unsynced metadata buffers in ext2_evict_inode() on
  mmb_sync() race
--

commit 87b835e8b247e4798e3fb46ec519ae23df154b20
Author: Christian Brauner <brauner@kernel.org>

ext2: drop mmb_sync() from ext2_evict_inode()

This commit removes the mmb_sync() call from ext2_evict_inode(), relying on
evict() to write out metadata buffers tracked via I_METADATA_WRITEBACK.

> diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
> index 9261b666d043a..4c38a3a8ea4d7 100644
> --- a/fs/ext2/inode.c
> +++ b/fs/ext2/inode.c
> @@ -91,8 +91,6 @@ void ext2_evict_inode(struct inode * inode)
>  		if (inode->i_blocks)
>  			ext2_truncate_blocks(inode, 0);
>  		ext2_xattr_delete_inode(inode);
> -	} else {
> -		mmb_sync(&EXT2_I(inode)->i_metadata_bhs);
>  	}
>  	mmb_invalidate(&EXT2_I(inode)->i_metadata_bhs);
>  	clear_inode(inode);

[Severity: Medium]
Can ext2_evict_inode() invalidate dirty metadata buffers on i_metadata_bhs
without writing them out if mmb_mark_buffer_dirty() races with mmb_sync()?

In __ext2_truncate_blocks(), ext2_free_branches() modifies
partial->bh->b_data and calls mark_inode_dirty(inode) before calling
mmb_mark_buffer_dirty().  If a concurrent writeback clears I_DIRTY and
I_METADATA_WRITEBACK in __writeback_single_inode() and enters mmb_sync(),
mmb_sync() temporarily sets bh->b_mmb to NULL in __remove_assoc_queue() and
restores bh->b_mmb = mmb if the buffer was dirtied again:

CPU0                                  CPU1
__ext2_truncate_blocks()
  ext2_free_branches()
    mark_inode_dirty(inode)
                                      __writeback_single_inode()
                                        inode_state_clear(...,
                                          I_METADATA_WRITEBACK)
                                        ext2_sync_inode_metadata()
                                          mmb_sync()
                                            spin_lock(&mmb->lock)
                                            __remove_assoc_queue()
                                              bh->b_mmb = NULL
  mmb_mark_buffer_dirty()
    mark_buffer_dirty(bh)
    if (!bh->b_mmb) // true
                                            if (buffer_dirty(bh)) {
                                              list_add(..., &mmb->list)
                                              bh->b_mmb = mmb
                                            }
                                            spin_unlock(&mmb->lock)
      spin_lock(&mmb->lock)
      if (cmpxchg(&bh->b_mmb,
                  NULL, mmb) != NULL) {
        spin_unlock(&mmb->lock)
        return;  <-- skips setting I_METADATA_WRITEBACK
      }

Because mmb_sync() only waits on in-flight I/O in its second loop without
submitting new I/O for the re-dirtied buffer, and mmb_mark_buffer_dirty()
returns early without setting I_METADATA_WRITEBACK, the dirty buffer remains
on i_metadata_bhs with I_METADATA_WRITEBACK clear on the inode.

With mmb_sync() removed from ext2_evict_inode(), evict() skips
sync_inode_metadata() and ext2_evict_inode() detaches the dirty buffer via
mmb_invalidate().  If the inode is later re-read from disk and fsync()ed
before background block device writeback flushes the buffer, fsync() will no
longer see the buffer on i_metadata_bhs and can return before the indirect
block is persisted to disk.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-work-inode-metadata_writeback-v3-0-91ac6c024018@kernel.org?part=10