github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-11 20:13:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

Browse Source 
xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous
xfs_trans_commit(), which flushes the CIL push workqueue internally.
If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to
lock these buffers to fail them, causing a deadlock:

  setlabel:          holds buf lock -> flush_workqueue(xfs-cil)
  CIL push worker:   xfs_buf_item_unpin -> xfs_buf_lock(same buf)

Remove the xfs_trans_bhold() calls so that commit releases the buffer
locks normally.  After the sync commit, re-acquire the buffers via
mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.

Fixes: f7664b3197 ("xfs: implement online get/set fs label")
Reported-by: syzbot+837bcd54843dd6262f2f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=837bcd54843dd6262f2f
Cc: stable@vger.kernel.org
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
This commit is contained in:
Yun Zhou 2026-07-31 11:10:10 +08:00 committed by Carlos Maiolino
parent 818bebeb63
commit 41a28c865d
2 changed files with 22 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fs/xfs/libxfs/xfs_rtgroup.h
View File

@ -359,7 +359,11 @@ static inline int xfs_initialize_rtgroups(struct xfs_mount *mp,
# define xfs_rtgroup_unlock(rtg, gf) ((void)0)
# define xfs_rtgroup_trans_join(tp, rtg, gf) ((void)0)
# define xfs_update_rtsb(bp, sb_bp) ((void)0)
# define xfs_log_rtsb(tp, sb_bp) (NULL)
static inline struct xfs_buf *xfs_log_rtsb(struct xfs_trans *tp,
const struct xfs_buf *sb_bp)
{
return NULL;
}
# define xfs_rtgroup_get_geometry(rtg, rgeo) (-EOPNOTSUPP)
#endif /* CONFIG_XFS_RT */

37
fs/xfs/libxfs/xfs_sb.c
View File

@ -1470,36 +1470,33 @@ xfs_sync_sb_buf(
bool update_rtsb)
{
struct xfs_trans *tp;
struct xfs_buf *bp;
struct xfs_buf *rtsb_bp = NULL;
int error;
error = xfs_trans_alloc(mp, &M_RES(mp)->tr_sb, 0, 0, 0, &tp);
if (error)
return error;
bp = xfs_trans_getsb(tp);
xfs_log_sb(tp);
xfs_trans_bhold(tp, bp);
if (update_rtsb) {
rtsb_bp = xfs_log_rtsb(tp, bp);
if (rtsb_bp)
xfs_trans_bhold(tp, rtsb_bp);
}
if (update_rtsb)
xfs_log_rtsb(tp, xfs_trans_getsb(tp));
xfs_trans_set_sync(tp);
error = xfs_trans_commit(tp);
if (error)
goto out;
/*
* write out the sb buffer to get the changes to disk
*/
error = xfs_bwrite(bp);
if (!error && rtsb_bp)
error = xfs_bwrite(rtsb_bp);
out:
if (rtsb_bp)
xfs_buf_relse(rtsb_bp);
xfs_buf_relse(bp);
return error;
/* Re-acquire and write the sb and rtsb to disk. */
xfs_buf_lock(mp->m_sb_bp);
error = xfs_bwrite(mp->m_sb_bp);
xfs_buf_unlock(mp->m_sb_bp);
if (error)
return error;
if (update_rtsb && mp->m_rtsb_bp) {
xfs_buf_lock(mp->m_rtsb_bp);
error = xfs_bwrite(mp->m_rtsb_bp);
xfs_buf_unlock(mp->m_rtsb_bp);
}
return error;
}