Linux-BTRFS Archive on
 help / color / Atom feed
From: Josef Bacik <>
Subject: Re: [PATCH] Btrfs: fix negative subv_writers counter and data space leak after buffered write
Date: Fri, 11 Oct 2019 09:27:42 -0400
Message-ID: <20191011132741.6zrjhv22j4otl6jc@MacBook-Pro-91.local> (raw)
In-Reply-To: <>

On Wed, Oct 09, 2019 at 05:44:22PM +0100, wrote:
> From: Filipe Manana <>
> When doing a buffered write it's possible to leave the subv_writers
> counter of the root, used for synchronization between buffered nocow
> writers and snapshotting. This happens in an exceptional case like the
> following:
> 1) We fail to allocate data space for the write, since there's not
>    enough available data space nor enough unallocated space for allocating
>    a new data block group;
> 2) Because of that failure, we try to go to NOCOW mode, which succeeds
>    and therefore we set the local variable 'only_release_metadata' to true
>    and set the root's sub_writers counter to 1 through the call to
>    btrfs_start_write_no_snapshotting() made by check_can_nocow();
> 3) The call to btrfs_copy_from_user() returns zero, which is very unlikely
>    to happen but not impossible;
> 4) No pages are copied because btrfs_copy_from_user() returned zero;
> 5) We call btrfs_end_write_no_snapshotting() which decrements the root's
>    subv_writers counter to 0;
> 6) We don't set 'only_release_metadata' back to 'false' because we do
>    it only if 'copied', the value returned by btrfs_copy_from_user(), is
>    greater than zero;
> 7) On the next iteration of the while loop, which processes the same
>    page range, we are now able to allocate data space for the write (we
>    got enough data space released in the meanwhile);
> 8) After this if we fail at btrfs_delalloc_reserve_metadata(), because
>    now there isn't enough free metadata space, or in some other place
>    further below (prepare_pages(), lock_and_cleanup_extent_if_need(),
>    btrfs_dirty_pages()), we break out of the while loop with
>    'only_release_metadata' having a value of 'true';
> 9) Because 'only_release_metadata' is 'true' we end up decrementing the
>    root's subv_writers counter to -1, and we also end up not releasing the
>    data space previously reserved through btrfs_check_data_free_space().
>    As a consequence the mechanism for synchronizing NOCOW buffered writes
>    with snapshotting gets broken.
> Fix this by always setting 'only_release_metadata' to false whenever it
> currently has a true value, independently of having been able to copy any
> data to the pages.

Can we accomplish the same thing by just doing

only_release_metadata = false;

at the start of the loop?  That way we only ever deal with it in its current
scope?  Thanks,


  reply index

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-09 16:44 fdmanana
2019-10-11 13:27 ` Josef Bacik [this message]
2019-10-11 15:40   ` Filipe Manana
2019-10-11 15:41 ` [PATCH v2] " fdmanana
2019-10-11 17:14   ` Josef Bacik
2019-10-11 18:23   ` David Sterba

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191011132741.6zrjhv22j4otl6jc@MacBook-Pro-91.local \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-BTRFS Archive on

Archives are clonable:
	git clone --mirror linux-btrfs/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-btrfs linux-btrfs/ \
	public-inbox-index linux-btrfs

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone public-inbox