From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792595573; b=wwZGMmsiNeXz2ec9BUUiuLls8IOXIRUuYHWdGrUrg4wKSNgD+647DmouV13jEZv+ZQqq kfCbVSK9g4QB3WGUVR35gWGuWD9zvIPIfvI+M6zc/uP5y05OkszEvAOZ+XtU2gFK9xOyO +QSppJoC6ScihqHOO6ryoWrJTqS7o3H7fpPSMjfQxdhriGocn90+bkrXrnVg1UK6twRAB cGRZKzaoYDRQRXDrPcTbZGBYH0aXU/OUno0atwNeUA/9I4cNuoliBTTDveMrMpDj9FFWg qNQ2ssN5PdujCfUp9pB8e5Y4njdi8U2jZeGYFxfLIh3wydPDYeTKAJqH5xq+L9XMOhg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792595573; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=p9OcMEBMBJtm9jjqSHyOFZ9xn0X9v7o6NC24coj6fVI=; b=M6/caw4tYpCpxEpt3Fgl7dl9Kwrncrqct7U76mnmBsK/XfV10im0w+Wfofzp2RddBwJQ rFS+wpI4rx2tMoLICpQB1v9qjLdqZWUNd17juDeZX88pk46g2/ztKvqLBV0qIKvRilNUp u/Yod6nYC6hw+G3fFhLOv2vAngvPWhA6Y5698hWADYQk2iIeCqhScCnVMFF1U12rNdzFO dE79KMFqWNhenAprmUX4zjpwu/4DopA3yY10j84vR1oRjeOXaUsFp34iQwSjCt4zftT/h kpHo+f9SYJ147H3reIhVVnyCUQFe3mgBaOfnT8VsLraTSm/FX3nMVtPdl9qW4YikG+w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Sk34JZC1; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 10D38606A31B for ; Wed, 21 Oct 2026 15:12:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Sk34JZC1 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 651ED1F000C1; Wed, 21 Oct 2026 15:12:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792595572; bh=p9OcMEBMBJtm9jjqSHyOFZ9xn0X9v7o6NC24coj6fVI=; h=Subject:To:Cc:From:Date; b=Sk34JZC14Im88H2BnVNDE53eE9Eq4J/eJBpUXgFPywNqstYFPCOGUu8vXwbeGnhF7 lUr/jLKHJS9REp6WmPw2QfhXEDxdRo6v2wwQfA086paNfIkweItMqzy3KbvmxGuAdO puDFuGlPpW6hck75GuOz7N01bUGKquwanehF+ceI= Subject: FAILED: patch "[PATCH] xfs: don't hold buffer locks across sync transaction commit" failed to apply to 5.15-stable tree To: yun.zhou@windriver.com,cem@kernel.org,hch@lst.de Cc: From: Date: Wed, 21 Oct 2026 17:08:22 +0200 Message-ID: <2026102122-lapdog-celibate-e8d8@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff # git commit -s git send-email --to '' --in-reply-to '2026102122-lapdog-celibate-e8d8@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff Mon Sep 17 00:00:00 2001 From: Yun Zhou Date: Fri, 31 Jul 2026 11:10:10 +0800 Subject: [PATCH] xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to lock these buffers to fail them, causing a deadlock: setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf) Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback. Fixes: f7664b31975b ("xfs: implement online get/set fs label") Reported-by: syzbot+837bcd54843dd6262f2f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=837bcd54843dd6262f2f Cc: stable@vger.kernel.org Signed-off-by: Yun Zhou Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino diff --git a/fs/xfs/libxfs/xfs_rtgroup.h b/fs/xfs/libxfs/xfs_rtgroup.h index c0b9f9f2c413..fca2eb74908c 100644 --- a/fs/xfs/libxfs/xfs_rtgroup.h +++ b/fs/xfs/libxfs/xfs_rtgroup.h @@ -359,7 +359,11 @@ static inline int xfs_initialize_rtgroups(struct xfs_mount *mp, # define xfs_rtgroup_unlock(rtg, gf) ((void)0) # define xfs_rtgroup_trans_join(tp, rtg, gf) ((void)0) # define xfs_update_rtsb(bp, sb_bp) ((void)0) -# define xfs_log_rtsb(tp, sb_bp) (NULL) +static inline struct xfs_buf *xfs_log_rtsb(struct xfs_trans *tp, + const struct xfs_buf *sb_bp) +{ + return NULL; +} # define xfs_rtgroup_get_geometry(rtg, rgeo) (-EOPNOTSUPP) #endif /* CONFIG_XFS_RT */ diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c index 75f2a021ee6d..f0341adbb879 100644 --- a/fs/xfs/libxfs/xfs_sb.c +++ b/fs/xfs/libxfs/xfs_sb.c @@ -1470,36 +1470,33 @@ xfs_sync_sb_buf( bool update_rtsb) { struct xfs_trans *tp; - struct xfs_buf *bp; - struct xfs_buf *rtsb_bp = NULL; int error; error = xfs_trans_alloc(mp, &M_RES(mp)->tr_sb, 0, 0, 0, &tp); if (error) return error; - bp = xfs_trans_getsb(tp); xfs_log_sb(tp); - xfs_trans_bhold(tp, bp); - if (update_rtsb) { - rtsb_bp = xfs_log_rtsb(tp, bp); - if (rtsb_bp) - xfs_trans_bhold(tp, rtsb_bp); - } + if (update_rtsb) + xfs_log_rtsb(tp, xfs_trans_getsb(tp)); xfs_trans_set_sync(tp); error = xfs_trans_commit(tp); if (error) - goto out; - /* - * write out the sb buffer to get the changes to disk - */ - error = xfs_bwrite(bp); - if (!error && rtsb_bp) - error = xfs_bwrite(rtsb_bp); -out: - if (rtsb_bp) - xfs_buf_relse(rtsb_bp); - xfs_buf_relse(bp); + return error; + + /* Re-acquire and write the sb and rtsb to disk. */ + xfs_buf_lock(mp->m_sb_bp); + error = xfs_bwrite(mp->m_sb_bp); + xfs_buf_unlock(mp->m_sb_bp); + if (error) + return error; + + if (update_rtsb && mp->m_rtsb_bp) { + xfs_buf_lock(mp->m_rtsb_bp); + error = xfs_bwrite(mp->m_rtsb_bp); + xfs_buf_unlock(mp->m_rtsb_bp); + } + return error; }