summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorJosef Bacik <josef@toxicpanda.com>2019-11-19 13:59:35 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-01-04 13:34:18 +0100
commitd03068998be9cd56709c17c5fa232284ee5f607f (patch)
treee00d52d465189ae57252339b7aac227925fed9eb /fs
parentd88d0a210db76f0e36c04f3c58ec80f028bdd1c1 (diff)
downloadlinux-stable-d03068998be9cd56709c17c5fa232284ee5f607f.tar.gz
linux-stable-d03068998be9cd56709c17c5fa232284ee5f607f.tar.bz2
linux-stable-d03068998be9cd56709c17c5fa232284ee5f607f.zip
btrfs: do not call synchronize_srcu() in inode_tree_del
[ Upstream commit f72ff01df9cf5db25c76674cac16605992d15467 ] Testing with the new fsstress uncovered a pretty nasty deadlock with lookup and snapshot deletion. Process A unlink -> final iput -> inode_tree_del -> synchronize_srcu(subvol_srcu) Process B btrfs_lookup <- srcu_read_lock() acquired here -> btrfs_iget -> find inode that has I_FREEING set -> __wait_on_freeing_inode() We're holding the srcu_read_lock() while doing the iget in order to make sure our fs root doesn't go away, and then we are waiting for the inode to finish freeing. However because the free'ing process is doing a synchronize_srcu() we deadlock. Fix this by dropping the synchronize_srcu() in inode_tree_del(). We don't need people to stop accessing the fs root at this point, we're only adding our empty root to the dead roots list. A larger much more invasive fix is forthcoming to address how we deal with fs roots, but this fixes the immediate problem. Fixes: 76dda93c6ae2 ("Btrfs: add snapshot/subvolume destroy ioctl") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/btrfs/inode.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 383717ccecc7..548e9cd1a337 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5506,7 +5506,6 @@ static void inode_tree_del(struct inode *inode)
spin_unlock(&root->inode_lock);
if (empty && btrfs_root_refs(&root->root_item) == 0) {
- synchronize_srcu(&root->fs_info->subvol_srcu);
spin_lock(&root->inode_lock);
empty = RB_EMPTY_ROOT(&root->inode_tree);
spin_unlock(&root->inode_lock);