From ff1227f70eead8704ecfec69259fb4c041f92cda Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi Date: Thu, 24 Sep 2026 01:41:19 +0900 Subject: [PATCH] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode() Syzbot reported a deadlock between nilfs_evict_inode(), executed via an asynchronous workqueue (kworker) as: process_one_work() process_scheduled_works() nilfs_iput_work_func() nilfs_dispose_list() iput() iput_final() evict() s_op->evict_inode() nilfs_evict_inode() and find_inode(), called via nilfs_mkdir() nilfs_new_inode() nilfs_insert_inode_locked() insert_inode_locked4() inode_insert5() find_inode() When an inode is deleted (i_nlink == 0), nilfs_evict_inode() clears its ifile bitmap entry and then synchronously triggers the log writer via nilfs_transaction_commit() if IS_SYNC(inode) is true. If a concurrent directory creation via nilfs_new_inode() attempts to allocate the same newly freed inode number, however, find_inode() called just before inserting it into the inode hash, blocks waiting for the old inode's evict() to complete. Meanwhile, the synchronous log writer invoked from nilfs_evict_inode() tries to acquire a write lock on 'ns_segctor_sem' which is read locked by the caller of nilfs_new_inode() (in this case, nilfs_mkdir()), resulting in a deadlock. The synchronous log writer invocation from nilfs_evict_inode() is a legacy artifact; it is no longer necessary because the call itself (triggered by iput()) is now handled asynchronously with a kworker if i_nlink == 0. It merely increases the risk of deadlock. Fix this deadlock by removing the synchronous log writer trigger from nilfs_evict_inode(). Reported-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6646318bbcf419411bc5 Fixes: 7ef3ff2fea8b ("nilfs2: fix deadlock of segment constructor over I_SYNC flag") Tested-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Ryusuke Konishi Signed-off-by: Viacheslav Dubeyko --- fs/nilfs2/inode.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 05e0389a5fa3..c739726f9862 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -875,13 +875,7 @@ void nilfs_evict_inode(struct inode *inode) nilfs_clear_inode(inode); - if (IS_SYNC(inode)) - nilfs_set_transaction_flag(NILFS_TI_SYNC); nilfs_transaction_commit(sb); - /* - * May construct a logical segment and may fail in sync mode. - * But delete_inode has no return value. - */ } int nilfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,