From: Nikolay Borisov <nborisov@suse.com>
To: Josef Bacik <josef@toxicpanda.com>, Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: clm@fb.com, dsterba@suse.com, linux-btrfs@vger.kernel.org,
linux-kernel <linux-kernel@vger.kernel.org>
Subject: Re: [BUG] fs: btrfs: several possible ABBA deadlocks
Date: Mon, 29 Nov 2021 16:37:14 +0200 [thread overview]
Message-ID: <8c1f9493-ef50-635e-4426-61120c4b1a86@suse.com> (raw)
In-Reply-To: <YaQgFhuaQHsND/jr@localhost.localdomain>
On 29.11.21 г. 2:34, Josef Bacik wrote:
> On Sat, Nov 27, 2021 at 04:23:37PM +0800, Jia-Ju Bai wrote:
>> Hello,
>>
>> My static analysis tool reports several possible ABBA deadlocks in the btrfs
>> module in Linux 5.10:
>>
>> # DEADLOCK 1:
>> __clear_extent_bit()
>> spin_lock(&tree->lock); --> Line 733 (Lock A)
>> split_state()
>> btrfs_split_delalloc_extent()
>> spin_lock(&BTRFS_I(inode)->lock); --> Line 1870 (Lock B)
>>
>> btrfs_inode_safe_disk_i_size_write()
>> spin_lock(&BTRFS_I(inode)->lock); --> Line 53 (Lock B)
>> find_contiguous_extent_bit()
>> spin_lock(&tree->lock); --> Line 1620 (Lock A)
>>
>> When __clear_extent_bit() and btrfs_inode_safe_disk_i_size_write() are
>> concurrently executed, the deadlock can occur.
>>
>> # DEADLOCK 2:
>> __set_extent_bit()
>> spin_lock(&tree->lock); --> Line 995 (Lock A)
>> set_state_bits()
>> btrfs_set_delalloc_extent()
>> spin_lock(&BTRFS_I(inode)->lock); --> Line 2007 or 2017 or 2029 (Lock
>> B)
>>
>> btrfs_inode_safe_disk_i_size_write()
>> spin_lock(&BTRFS_I(inode)->lock); --> Line 53 (Lock B)
>> find_contiguous_extent_bit()
>> spin_lock(&tree->lock); --> Line 1620 (Lock A)
>>
>> When __set_extent_bit() and btrfs_inode_safe_disk_i_size_write() are
>> concurrently executed, the deadlock can occur.
>>
>> # DEADLOCK 3:
>> convert_extent_bit()
>> spin_lock(&tree->lock); --> Line 1241 (Lock A)
>> set_state_bits()
>> btrfs_set_delalloc_extent()
>> spin_lock(&BTRFS_I(inode)->lock); --> Line 2007 or 2017 or 2029 (Lock
>> B)
>>
>> btrfs_inode_safe_disk_i_size_write()
>> spin_lock(&BTRFS_I(inode)->lock); --> Line 53 (Lock B)
>> find_contiguous_extent_bit()
>> spin_lock(&tree->lock); --> Line 1620 (Lock A)
>>
>> When convert_extent_bit() and btrfs_inode_safe_disk_i_size_write() are
>> concurrently executed, the deadlock can occur.
>>
>> I am not quite sure whether these possible deadlocks are real and how to fix
>> them if they are real.
>> Any feedback would be appreciated, thanks :)
>>
>
> Hey Jia-Ju,
>
> This is pretty good work, unfortunately it's wrong but it's in a subtle way that
> a tool wouldn't be able to catch. The btrfs_inode_safe_disk_i_size_write()
> helper only messes with BTRFS_I(inode)->file_extent_tree, which is separate from
> the BTRFS_I(inode)->io_tree. io_tree gets the btrfs_set_delalloc_extent() stuff
> called on it, but the file_extent_tree does not. The file_extent_tree has
> inode->lock -> tree->lock as the locking order, whereas the file_extent_tree has
> inode->lock -> tree->lock as the locking order. Thanks,
nit: did you mean to reverse tree->lock ->inode->lock for the
file_extent_tree?
>
> Josef
>
prev parent reply other threads:[~2021-11-29 14:39 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-27 8:23 [BUG] fs: btrfs: several possible ABBA deadlocks Jia-Ju Bai
2021-11-29 0:34 ` Josef Bacik
2021-11-29 1:48 ` Jia-Ju Bai
2021-11-29 14:37 ` Nikolay Borisov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8c1f9493-ef50-635e-4426-61120c4b1a86@suse.com \
--to=nborisov@suse.com \
--cc=baijiaju1990@gmail.com \
--cc=clm@fb.com \
--cc=dsterba@suse.com \
--cc=josef@toxicpanda.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).