[PATCH v2 0/2] bcachefs: Fix readahead involved deadlock

[PATCH v2 0/2] bcachefs: Fix readahead involved deadlock

[Alan Huang]

Changes since v1:
 - Revert the readahead status so that caller could handle it correctly.
 - Factor out readpages_iter_folio_revert to simplify code.

Alan Huang (2):
  bcachefs: Fix readahead involved deadlock
  bcachefs: Factor out readpages_iter_folio_revert

 fs/bcachefs/fs-io-buffered.c | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

-- 
2.49.0

[PATCH v2 1/2] bcachefs: Fix readahead involved deadlock

[Alan Huang]

readahead first lock the folio, then invokes aops->readahead, which
locks the two state lock to block subsequent direct I/O. However,
direct IO or bchfs_fpunch first lock the two state lock to block
subsequent buffered I/O, and then lock the folio to invalidate or
truncate it. Therefore, there is a deadlock:

thread1			thread2
lock folio		bch2_pagecache_block_get
bch2_pagecache_add_get 	lock folio

Reported-by: syzbot+23e4a7772eb9a9715b85@syzkaller.appspotmail.com
Signed-off-by: Alan Huang <mmpgouride@gmail.com>
---
 fs/bcachefs/fs-io-buffered.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/fs/bcachefs/fs-io-buffered.c b/fs/bcachefs/fs-io-buffered.c
index c5ed62a11f23..9f6f9f0f21ff 100644
--- a/fs/bcachefs/fs-io-buffered.c
+++ b/fs/bcachefs/fs-io-buffered.c
@@ -64,6 +64,17 @@ static int readpages_iter_init(struct readpages_iter *iter,
 	return 0;
 }
 
+static void readpages_iter_exit(struct readpages_iter *iter,
+			        struct readahead_control *ractl)
+{
+	darray_for_each_reverse(iter->folios, folio) {
+		bch2_folio_release(*folio);
+		ractl->_nr_pages += folio_nr_pages(*folio);
+		ractl->_index -= folio_nr_pages(*folio);
+		folio_get(*folio);
+	}
+}
+
 static inline struct folio *readpage_iter_peek(struct readpages_iter *iter)
 {
 	if (iter->idx >= iter->folios.nr)
@@ -290,7 +301,10 @@ void bch2_readahead(struct readahead_control *ractl)
 	 * scheduling.
 	 */
 	blk_start_plug(&plug);
-	bch2_pagecache_add_get(inode);
+	if (!bch2_pagecache_add_tryget(inode)) {
+		readpages_iter_exit(&readpages_iter, ractl);
+		goto out;
+	}
 
 	struct btree_trans *trans = bch2_trans_get(c);
 	while ((folio = readpage_iter_peek(&readpages_iter))) {
@@ -317,6 +331,7 @@ void bch2_readahead(struct readahead_control *ractl)
 	bch2_trans_put(trans);
 
 	bch2_pagecache_add_put(inode);
+out:
 	blk_finish_plug(&plug);
 	darray_exit(&readpages_iter.folios);
 }
-- 
2.49.0

[PATCH v2 2/2] bcachefs: Factor out readpages_iter_folio_revert

[Alan Huang]

Signed-off-by: Alan Huang <mmpgouride@gmail.com>
---
 fs/bcachefs/fs-io-buffered.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/fs/bcachefs/fs-io-buffered.c b/fs/bcachefs/fs-io-buffered.c
index 9f6f9f0f21ff..fd8beb5167ee 100644
--- a/fs/bcachefs/fs-io-buffered.c
+++ b/fs/bcachefs/fs-io-buffered.c
@@ -42,6 +42,14 @@ struct readpages_iter {
 	folios			folios;
 };
 
+static inline void readpages_iter_folio_revert(struct readahead_control *ractl,
+					       struct folio *folio)
+{
+	bch2_folio_release(folio);
+	ractl->_nr_pages += folio_nr_pages(folio);
+	ractl->_index -= folio_nr_pages(folio);
+}
+
 static int readpages_iter_init(struct readpages_iter *iter,
 			       struct readahead_control *ractl)
 {
@@ -52,9 +60,7 @@ static int readpages_iter_init(struct readpages_iter *iter,
 	while ((folio = __readahead_folio(ractl))) {
 		if (!bch2_folio_create(folio, GFP_KERNEL) ||
 		    darray_push(&iter->folios, folio)) {
-			bch2_folio_release(folio);
-			ractl->_nr_pages += folio_nr_pages(folio);
-			ractl->_index -= folio_nr_pages(folio);
+			readpages_iter_folio_revert(ractl, folio);
 			return iter->folios.nr ? 0 : -ENOMEM;
 		}
 
@@ -68,9 +74,7 @@ static void readpages_iter_exit(struct readpages_iter *iter,
 			        struct readahead_control *ractl)
 {
 	darray_for_each_reverse(iter->folios, folio) {
-		bch2_folio_release(*folio);
-		ractl->_nr_pages += folio_nr_pages(*folio);
-		ractl->_index -= folio_nr_pages(*folio);
+		readpages_iter_folio_revert(ractl, *folio);
 		folio_get(*folio);
 	}
 }
-- 
2.49.0