[bug report] btrfs: convert the buffer_radix to an xarray

[bug report] btrfs: convert the buffer_radix to an xarray

[Dan Carpenter]

Hello Josef Bacik,

Commit 19d7f65f032f ("btrfs: convert the buffer_radix to an xarray")
from Apr 28, 2025 (linux-next), leads to the following Smatch static
checker warning:

	fs/btrfs/extent_io.c:4336 try_release_subpage_extent_buffer()
	warn: double unlock '&(&fs_info->buffer_tree)->xa_lock' (orig line 4316)

fs/btrfs/extent_io.c
    4296 static int try_release_subpage_extent_buffer(struct folio *folio)
    4297 {
    4298         struct btrfs_fs_info *fs_info = folio_to_fs_info(folio);
    4299         struct extent_buffer *eb;
    4300         unsigned long start = (folio_pos(folio) >> fs_info->sectorsize_bits);
    4301         unsigned long index = start;
    4302         unsigned long end = index + (PAGE_SIZE >> fs_info->sectorsize_bits) - 1;
    4303         int ret;
    4304 
    4305         xa_lock_irq(&fs_info->buffer_tree);
    4306         xa_for_each_range(&fs_info->buffer_tree, index, eb, start, end) {
    4307                 /*
    4308                  * The same as try_release_extent_buffer(), to ensure the eb
    4309                  * won't disappear out from under us.
    4310                  */
    4311                 spin_lock(&eb->refs_lock);
    4312                 if (atomic_read(&eb->refs) != 1 || extent_buffer_under_io(eb)) {
    4313                         spin_unlock(&eb->refs_lock);
    4314                         continue;
    4315                 }
    4316                 xa_unlock_irq(&fs_info->buffer_tree);

unlock

    4317 
    4318                 /*
    4319                  * If tree ref isn't set then we know the ref on this eb is a
    4320                  * real ref, so just return, this eb will likely be freed soon
    4321                  * anyway.
    4322                  */
    4323                 if (!test_and_clear_bit(EXTENT_BUFFER_TREE_REF, &eb->bflags)) {
    4324                         spin_unlock(&eb->refs_lock);
    4325                         break;

hit the break

    4326                 }
    4327 
    4328                 /*
    4329                  * Here we don't care about the return value, we will always
    4330                  * check the folio private at the end.  And
    4331                  * release_extent_buffer() will release the refs_lock.
    4332                  */
    4333                 release_extent_buffer(eb);
    4334                 xa_lock_irq(&fs_info->buffer_tree);
    4335         }
--> 4336         xa_unlock_irq(&fs_info->buffer_tree);

double unlock

    4337 
    4338         /*
    4339          * Finally to check if we have cleared folio private, as if we have
    4340          * released all ebs in the page, the folio private should be cleared now.
    4341          */
    4342         spin_lock(&folio->mapping->i_private_lock);
    4343         if (!folio_test_private(folio))
    4344                 ret = 1;
    4345         else
    4346                 ret = 0;
    4347         spin_unlock(&folio->mapping->i_private_lock);
    4348         return ret;
    4349 
    4350 }

regards,
dan carpenter