[PATCH] btrfs: take delayed_node mutex when releasing item

[PATCH] btrfs: take delayed_node mutex when releasing item

[Leo Martins]

The error path in btrfs_delete_delayed_dir_index does not take
the delayed_node mutex when releasing delayed item.
btrfs_release_delayed_item -> __btrfs_remove_delayed_item which
has lockdep_assert_held(&delayed_node->mutex)

Fix this by taking the mutex when releasing.

Fixes: 933c22a7512c ("btrfs: delayed-inode: Kill the BUG_ON() in btrfs_delete_delayed_dir_index()")
Signed-off-by: Leo Martins <loemra.dev@gmail.com>
---
 fs/btrfs/delayed-inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index e77a597580c5..30dd067e2db3 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1662,7 +1662,9 @@ int btrfs_delete_delayed_dir_index(struct btrfs_trans_handle *trans,
 		btrfs_err(trans->fs_info,
 "metadata reservation failed for delayed dir item deletion, index: %llu, root: %llu, inode: %llu, error: %d",
 			  index, btrfs_root_id(node->root), node->inode_id, ret);
+		mutex_lock(&node->mutex);
 		btrfs_release_delayed_item(item);
+		mutex_unlock(&node->mutex);
 		goto end;
 	}
 
-- 
2.47.3

Re: [PATCH] btrfs: take delayed_node mutex when releasing item

[David Sterba]

On Tue, Nov 11, 2025 at 04:22:57PM -0800, Leo Martins wrote:
> The error path in btrfs_delete_delayed_dir_index does not take
> the delayed_node mutex when releasing delayed item.
> btrfs_release_delayed_item -> __btrfs_remove_delayed_item which
> has lockdep_assert_held(&delayed_node->mutex)
> 
> Fix this by taking the mutex when releasing.
> 
> Fixes: 933c22a7512c ("btrfs: delayed-inode: Kill the BUG_ON() in btrfs_delete_delayed_dir_index()")
> Signed-off-by: Leo Martins <loemra.dev@gmail.com>
> ---
>  fs/btrfs/delayed-inode.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
> index e77a597580c5..30dd067e2db3 100644
> --- a/fs/btrfs/delayed-inode.c
> +++ b/fs/btrfs/delayed-inode.c
> @@ -1662,7 +1662,9 @@ int btrfs_delete_delayed_dir_index(struct btrfs_trans_handle *trans,
>  		btrfs_err(trans->fs_info,
>  "metadata reservation failed for delayed dir item deletion, index: %llu, root: %llu, inode: %llu, error: %d",
>  			  index, btrfs_root_id(node->root), node->inode_id, ret);
> +		mutex_lock(&node->mutex);
>  		btrfs_release_delayed_item(item);
> +		mutex_unlock(&node->mutex);

I don't think it's needed, the item has been just allocated but not yet
added to the rbtree (__btrfs_add_delayed_item() a few lines below).

In btrfs_release_delayed_item() there's a check if the item is in the
rbtree, if not then nothing is done. Otherwise the lockdep assertion is
checked, and the locking would be needed.

Re: [PATCH] btrfs: take delayed_node mutex when releasing item

[Leo Martins]

On Wed, 12 Nov 2025 08:09:25 +0100 David Sterba <dsterba@suse.cz> wrote:

> On Tue, Nov 11, 2025 at 04:22:57PM -0800, Leo Martins wrote:
> > The error path in btrfs_delete_delayed_dir_index does not take
> > the delayed_node mutex when releasing delayed item.
> > btrfs_release_delayed_item -> __btrfs_remove_delayed_item which
> > has lockdep_assert_held(&delayed_node->mutex)
> > 
> > Fix this by taking the mutex when releasing.
> > 
> > Fixes: 933c22a7512c ("btrfs: delayed-inode: Kill the BUG_ON() in btrfs_delete_delayed_dir_index()")
> > Signed-off-by: Leo Martins <loemra.dev@gmail.com>
> > ---
> >  fs/btrfs/delayed-inode.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
> > index e77a597580c5..30dd067e2db3 100644
> > --- a/fs/btrfs/delayed-inode.c
> > +++ b/fs/btrfs/delayed-inode.c
> > @@ -1662,7 +1662,9 @@ int btrfs_delete_delayed_dir_index(struct btrfs_trans_handle *trans,
> >  		btrfs_err(trans->fs_info,
> >  "metadata reservation failed for delayed dir item deletion, index: %llu, root: %llu, inode: %llu, error: %d",
> >  			  index, btrfs_root_id(node->root), node->inode_id, ret);
> > +		mutex_lock(&node->mutex);
> >  		btrfs_release_delayed_item(item);
> > +		mutex_unlock(&node->mutex);
> 
> I don't think it's needed, the item has been just allocated but not yet
> added to the rbtree (__btrfs_add_delayed_item() a few lines below).
> 
> In btrfs_release_delayed_item() there's a check if the item is in the
> rbtree, if not then nothing is done. Otherwise the lockdep assertion is
> checked, and the locking would be needed.

Whoops, you're right, good catch.