From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D5CADC2D0CE for ; Sun, 29 Dec 2019 17:28:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A5BB9208E4 for ; Sun, 29 Dec 2019 17:28:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1577640490; bh=PdLIJqNP0qhgDm4kjLXmuiOrNEn+UR54zLGQicJ7uMo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=nyKvlhOvrm2uYhRWEdkELTozjZrXOidXynuOy4OjRcbBrIZnh3xqr/piSa6/6NKPf 9NDZaRuY0dd0ilkITaMdhma0klat9D7tJD4pUZ4/MbAkeiT4DyM/vxQOAA2eAlG7K1 8eXBVFKFjh3UpDaDmi9AyImoJcAn7eguuQjyYSNo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728544AbfL2R2J (ORCPT ); Sun, 29 Dec 2019 12:28:09 -0500 Received: from mail.kernel.org ([198.145.29.99]:51008 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728531AbfL2R2E (ORCPT ); Sun, 29 Dec 2019 12:28:04 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C53DC208E4; Sun, 29 Dec 2019 17:28:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1577640483; bh=PdLIJqNP0qhgDm4kjLXmuiOrNEn+UR54zLGQicJ7uMo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NijV9fyXRM0mbrXmUOGO+kTQQ4TL2VcZEUN9h85ceZxT6GWnOPkZLIfkOrJI/vat2 PQwc2txmsjZ6NWtN3oAWnXxSinlwWN/+EKRJzbkzbX+9s+xtzdvaVDLTJPIhIAUFib TfK6Oo2cAM8Ue1OVuNbXzKpQOU1cz3FhVUdp85jE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba Subject: [PATCH 4.19 015/219] btrfs: do not call synchronize_srcu() in inode_tree_del Date: Sun, 29 Dec 2019 18:16:57 +0100 Message-Id: <20191229162511.294306894@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20191229162508.458551679@linuxfoundation.org> References: <20191229162508.458551679@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Josef Bacik commit f72ff01df9cf5db25c76674cac16605992d15467 upstream. Testing with the new fsstress uncovered a pretty nasty deadlock with lookup and snapshot deletion. Process A unlink -> final iput -> inode_tree_del -> synchronize_srcu(subvol_srcu) Process B btrfs_lookup <- srcu_read_lock() acquired here -> btrfs_iget -> find inode that has I_FREEING set -> __wait_on_freeing_inode() We're holding the srcu_read_lock() while doing the iget in order to make sure our fs root doesn't go away, and then we are waiting for the inode to finish freeing. However because the free'ing process is doing a synchronize_srcu() we deadlock. Fix this by dropping the synchronize_srcu() in inode_tree_del(). We don't need people to stop accessing the fs root at this point, we're only adding our empty root to the dead roots list. A larger much more invasive fix is forthcoming to address how we deal with fs roots, but this fixes the immediate problem. Fixes: 76dda93c6ae2 ("Btrfs: add snapshot/subvolume destroy ioctl") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/inode.c | 2 -- 1 file changed, 2 deletions(-) --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -5665,7 +5665,6 @@ static void inode_tree_add(struct inode static void inode_tree_del(struct inode *inode) { - struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); struct btrfs_root *root = BTRFS_I(inode)->root; int empty = 0; @@ -5678,7 +5677,6 @@ static void inode_tree_del(struct inode spin_unlock(&root->inode_lock); if (empty && btrfs_root_refs(&root->root_item) == 0) { - synchronize_srcu(&fs_info->subvol_srcu); spin_lock(&root->inode_lock); empty = RB_EMPTY_ROOT(&root->inode_tree); spin_unlock(&root->inode_lock);