* [PATCH 1/1] fs: fix deadlock in insert_inode_locked() waiting for inode eviction
@ 2026-03-26 23:21 Xiang Shen
2026-03-26 23:29 ` Mateusz Guzik
0 siblings, 1 reply; 4+ messages in thread
From: Xiang Shen @ 2026-03-26 23:21 UTC (permalink / raw)
To: Alexander Viro, Christian Brauner
Cc: Jan Kara, Mateusz Guzik, linux-fsdevel, linux-kernel, stable, Xiang Shen
Commit 88ec797c4680 ("fs: make insert_inode_locked() wait for inode
destruction") changed insert_inode_locked() to sleep via
__wait_on_freeing_inode() when it encounters an inode being freed. This
introduces a deadlock when the caller already holds resources that the
eviction path needs.
For example, ext4_new_inode() holds an active jbd2 journal handle when
it calls insert_inode_locked(). If a stale inode with the same ino is
being freed, the function now sleeps waiting for eviction to complete.
However, ext4_evict_inode() needs to start a new journal transaction via
ext4_journal_start(), which may block in add_transaction_credits()
waiting for the current transaction to commit. That transaction cannot
commit because the caller's handle (in ext4_new_inode) is still active,
resulting in a deadlock:
Thread A (ext4_new_inode) Thread B (evicting old inode)
------------------------- ----------------------------
jbd2_journal_start() -> handle
insert_inode_locked()
finds old inode I_FREEING
__wait_on_freeing_inode()
schedule() [waits for B] ext4_evict_inode()
ext4_journal_start()
add_transaction_credits()
[waits for T to commit]
[T blocked by A's handle]
Fix this by replacing the blocking __wait_on_freeing_inode() call with a
non-blocking drop-and-retry loop. When a freeing inode is encountered,
drop both i_lock and inode_hash_lock, yield the CPU with cond_resched(),
and restart the outer while(1) loop via continue.
Unlike the pre-88ec797c4680 code which skipped freeing inodes within the
inner hlist_for_each_entry loop (risking duplicate inodes in the hash),
this fix restarts the entire lookup from scratch -- the new inode is only
inserted when no matching entry (including freeing ones) exists in the
hash chain.
Fixes: 88ec797c4680 ("fs: make insert_inode_locked() wait for inode destruction")
Cc: stable@vger.kernel.org
Signed-off-by: Xiang Shen <turyshen@gmail.com>
---
fs/inode.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/inode.c b/fs/inode.c
index cc12b68e021b..8ecdd297c83f 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1842,7 +1842,6 @@ int insert_inode_locked(struct inode *inode)
while (1) {
struct inode *old = NULL;
spin_lock(&inode_hash_lock);
-repeat:
hlist_for_each_entry(old, head, i_hash) {
if (old->i_ino != ino)
continue;
@@ -1860,9 +1859,10 @@ int insert_inode_locked(struct inode *inode)
return 0;
}
if (inode_state_read(old) & (I_FREEING | I_WILL_FREE)) {
- __wait_on_freeing_inode(old, true, false);
- old = NULL;
- goto repeat;
+ spin_unlock(&old->i_lock);
+ spin_unlock(&inode_hash_lock);
+ cond_resched();
+ continue;
}
if (unlikely(inode_state_read(old) & I_CREATING)) {
spin_unlock(&old->i_lock);
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH 1/1] fs: fix deadlock in insert_inode_locked() waiting for inode eviction
2026-03-26 23:21 [PATCH 1/1] fs: fix deadlock in insert_inode_locked() waiting for inode eviction Xiang Shen
@ 2026-03-26 23:29 ` Mateusz Guzik
[not found] ` <CAHLHtjzi5uKrNDyjL60nZ6TUZnae5gDaEHL8dwbMECBT1L6tdg@mail.gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Mateusz Guzik @ 2026-03-26 23:29 UTC (permalink / raw)
To: Xiang Shen
Cc: Alexander Viro, Christian Brauner, Jan Kara, linux-fsdevel,
linux-kernel, stable
On Fri, Mar 27, 2026 at 12:21 AM Xiang Shen <turyshen@gmail.com> wrote:
>
> Commit 88ec797c4680 ("fs: make insert_inode_locked() wait for inode
> destruction") changed insert_inode_locked() to sleep via
> __wait_on_freeing_inode() when it encounters an inode being freed. This
> introduces a deadlock when the caller already holds resources that the
> eviction path needs.
>
> For example, ext4_new_inode() holds an active jbd2 journal handle when
> it calls insert_inode_locked(). If a stale inode with the same ino is
> being freed, the function now sleeps waiting for eviction to complete.
> However, ext4_evict_inode() needs to start a new journal transaction via
> ext4_journal_start(), which may block in add_transaction_credits()
> waiting for the current transaction to commit. That transaction cannot
> commit because the caller's handle (in ext4_new_inode) is still active,
> resulting in a deadlock:
>
> Thread A (ext4_new_inode) Thread B (evicting old inode)
> ------------------------- ----------------------------
> jbd2_journal_start() -> handle
> insert_inode_locked()
> finds old inode I_FREEING
> __wait_on_freeing_inode()
> schedule() [waits for B] ext4_evict_inode()
> ext4_journal_start()
> add_transaction_credits()
> [waits for T to commit]
> [T blocked by A's handle]
>
> Fix this by replacing the blocking __wait_on_freeing_inode() call with a
> non-blocking drop-and-retry loop. When a freeing inode is encountered,
> drop both i_lock and inode_hash_lock, yield the CPU with cond_resched(),
> and restart the outer while(1) loop via continue.
>
Please see the ext4 fix:
https://lore.kernel.org/linux-ext4/20260320090428.24899-2-jack@suse.cz/
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-03-26 23:45 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-03-26 23:21 [PATCH 1/1] fs: fix deadlock in insert_inode_locked() waiting for inode eviction Xiang Shen
2026-03-26 23:29 ` Mateusz Guzik
[not found] ` <CAHLHtjzi5uKrNDyjL60nZ6TUZnae5gDaEHL8dwbMECBT1L6tdg@mail.gmail.com>
2026-03-26 23:42 ` Xiang Shen
2026-03-26 23:44 ` Mateusz Guzik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®