[PATCH v2] flex_proportions: Make fprop_new_period() hardirq safe

[PATCH v2] flex_proportions: Make fprop_new_period() hardirq safe

[Jan Kara]

Bernd has reported a lockdep splat from flexible proportions code that
is essentially complaining about the following race:

<timer fires>
run_timer_softirq - we are in softirq context
  call_timer_fn
    writeout_period
      fprop_new_period
        write_seqcount_begin(&p->sequence);

        <hardirq is raised>
        ...
        blk_mq_end_request()
	  blk_update_request()
	    ext4_end_bio()
	      folio_end_writeback()
		__wb_writeout_add()
		  __fprop_add_percpu_max()
		    if (unlikely(max_frac < FPROP_FRAC_BASE)) {
		      fprop_fraction_percpu()
			seq = read_seqcount_begin(&p->sequence);
			  - sees odd sequence so loops indefinitely

Note that a deadlock like this is only possible if the bdi has
configured maximum fraction of writeout throughput which is very rare
in general but frequent for example for FUSE bdis. To fix this problem
we have to make sure write section of the sequence counter is irqsafe.

CC: stable@vger.kernel.org
Fixes: a91befde3503 ("lib/flex_proportions.c: remove local_irq_ops in fprop_new_period()")
Reported-by: Bernd Schubert <bernd@bsbernd.com>
Link: https://lore.kernel.org/all/9b845a47-9aee-43dd-99bc-1a82bea00442@bsbernd.com/
Signed-off-by: Jan Kara <jack@suse.cz>
---
 lib/flex_proportions.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Sending v2 because I've messed up Andrew's address and forgot some tags in
the first posting...

diff --git a/lib/flex_proportions.c b/lib/flex_proportions.c
index 84ecccddc771..012d5614efb9 100644
--- a/lib/flex_proportions.c
+++ b/lib/flex_proportions.c
@@ -64,13 +64,14 @@ void fprop_global_destroy(struct fprop_global *p)
 bool fprop_new_period(struct fprop_global *p, int periods)
 {
 	s64 events = percpu_counter_sum(&p->events);
+	unsigned long flags;
 
 	/*
 	 * Don't do anything if there are no events.
 	 */
 	if (events <= 1)
 		return false;
-	preempt_disable_nested();
+	local_irq_save(flags);
 	write_seqcount_begin(&p->sequence);
 	if (periods < 64)
 		events -= events >> periods;
@@ -78,7 +79,7 @@ bool fprop_new_period(struct fprop_global *p, int periods)
 	percpu_counter_add(&p->events, -events);
 	p->period += periods;
 	write_seqcount_end(&p->sequence);
-	preempt_enable_nested();
+	local_irq_restore(flags);
 
 	return true;
 }
-- 
2.51.0

Re: [PATCH v2] flex_proportions: Make fprop_new_period() hardirq safe

[Matthew Wilcox]

On Wed, Jan 21, 2026 at 12:27:30PM +0100, Jan Kara wrote:
> Bernd has reported a lockdep splat from flexible proportions code that
> is essentially complaining about the following race:
[...]
> Note that a deadlock like this is only possible if the bdi has
> configured maximum fraction of writeout throughput which is very rare
> in general but frequent for example for FUSE bdis. To fix this problem
> we have to make sure write section of the sequence counter is irqsafe.

Ah, that's why we haven't seen it reported before.

> CC: stable@vger.kernel.org
> Fixes: a91befde3503 ("lib/flex_proportions.c: remove local_irq_ops in fprop_new_period()")
> Reported-by: Bernd Schubert <bernd@bsbernd.com>
> Link: https://lore.kernel.org/all/9b845a47-9aee-43dd-99bc-1a82bea00442@bsbernd.com/
> Signed-off-by: Jan Kara <jack@suse.cz>

Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>