mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [PATCH 0/5] assorted ->i_count-related changes
@ 2026-03-28 15:31 Mateusz Guzik
  2026-03-28 15:31 ` [PATCH 1/5] fs: add icount_read_once() Mateusz Guzik
                   ` (5 more replies)
  0 siblings, 6 replies; 15+ messages in thread
From: Mateusz Guzik @ 2026-03-28 15:31 UTC (permalink / raw)
  To: brauner; +Cc: viro, jack, linux-kernel, linux-fsdevel, Mateusz Guzik

The icount_read_once() stuff lines up with inode_state_read_once().
The prefix is different but I opted to not change it due to igrab(),
ihold() et al.

There is a future-proofing change in iput_final(). I am not going to
strongly insist on it, but at the very least the problem needs to be
noted in a comment.

Finally, igrab() gets lockless treatment. I verified btrfs likes to call
into it in writeback code with the count > 1, same with procfs during
process reaping. Grep shows nfs also calls there, but I have not checked
how often that happens. This is a minor single-threaded speed up at
least as a lock trip is avoided in the common case.

Mateusz Guzik (5):
  fs: add icount_read_once()
  Use icount_read() and icount_read_once() as appropriate.
  fs: enforce locking in icount_read(), add some commentary
  fs: handle hypothetical filesystems hich use I_DONTCACHE and drop the
    lock in ->drop_inode
  fs: locklessly bump refs in igrab as long as it does not transition
    0->1

 arch/powerpc/platforms/cell/spufs/file.c |  2 +-
 fs/btrfs/inode.c                         |  2 +-
 fs/ceph/mds_client.c                     |  2 +-
 fs/ext4/ialloc.c                         |  4 +--
 fs/hpfs/inode.c                          |  2 +-
 fs/inode.c                               | 42 ++++++++++++++++--------
 fs/nfs/inode.c                           |  4 +--
 fs/smb/client/inode.c                    |  2 +-
 fs/ubifs/super.c                         |  2 +-
 fs/xfs/xfs_inode.c                       |  2 +-
 fs/xfs/xfs_trace.h                       |  2 +-
 include/linux/fs.h                       | 13 ++++++++
 include/trace/events/filelock.h          |  2 +-
 security/landlock/fs.c                   |  2 +-
 14 files changed, 55 insertions(+), 28 deletions(-)

-- 
2.48.1


^ permalink raw reply	[flat|nested] 15+ messages in thread
* [PATCH] fs: revert insert_inode_locked() eviction wait change and explain why
@ 2026-03-16 10:33 Mateusz Guzik
  2026-03-17 13:01 ` Jan Kara
  0 siblings, 1 reply; 15+ messages in thread
From: Mateusz Guzik @ 2026-03-16 10:33 UTC (permalink / raw)
  To: brauner; +Cc: viro, jack, linux-kernel, linux-fsdevel, Mateusz Guzik, Lai, Yi

It causes a deadlock, reproducer can be found here:
https://lore.kernel.org/linux-fsdevel/abNvb2PcrKj1FBeC@ly-workstation/

The real bug is in ext4, but I'm not digging into it and a working order
needs to be restored.

Commentary is added as a warning sign for another sucker^Wdeveloper.

Fixes: 88ec797c468097a8 ("fs: make insert_inode_locked() wait for inode destruction")
Reported-by: "Lai, Yi" <yi1.lai@linux.intel.com>
Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
---

generated against master

FYI next has a change which has a trivial conflic (ino type change)

 fs/inode.c | 53 +++++++++++++++++++++++++++++------------------------
 1 file changed, 29 insertions(+), 24 deletions(-)

diff --git a/fs/inode.c b/fs/inode.c
index cc12b68e021b..5f7e76c9fb53 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1037,20 +1037,19 @@ long prune_icache_sb(struct super_block *sb, struct shrink_control *sc)
 	return freed;
 }
 
-static void __wait_on_freeing_inode(struct inode *inode, bool hash_locked, bool rcu_locked);
-
+static void __wait_on_freeing_inode(struct inode *inode, bool is_inode_hash_locked);
 /*
  * Called with the inode lock held.
  */
 static struct inode *find_inode(struct super_block *sb,
 				struct hlist_head *head,
 				int (*test)(struct inode *, void *),
-				void *data, bool hash_locked,
+				void *data, bool is_inode_hash_locked,
 				bool *isnew)
 {
 	struct inode *inode = NULL;
 
-	if (hash_locked)
+	if (is_inode_hash_locked)
 		lockdep_assert_held(&inode_hash_lock);
 	else
 		lockdep_assert_not_held(&inode_hash_lock);
@@ -1064,7 +1063,7 @@ static struct inode *find_inode(struct super_block *sb,
 			continue;
 		spin_lock(&inode->i_lock);
 		if (inode_state_read(inode) & (I_FREEING | I_WILL_FREE)) {
-			__wait_on_freeing_inode(inode, hash_locked, true);
+			__wait_on_freeing_inode(inode, is_inode_hash_locked);
 			goto repeat;
 		}
 		if (unlikely(inode_state_read(inode) & I_CREATING)) {
@@ -1088,11 +1087,11 @@ static struct inode *find_inode(struct super_block *sb,
  */
 static struct inode *find_inode_fast(struct super_block *sb,
 				struct hlist_head *head, unsigned long ino,
-				bool hash_locked, bool *isnew)
+				bool is_inode_hash_locked, bool *isnew)
 {
 	struct inode *inode = NULL;
 
-	if (hash_locked)
+	if (is_inode_hash_locked)
 		lockdep_assert_held(&inode_hash_lock);
 	else
 		lockdep_assert_not_held(&inode_hash_lock);
@@ -1106,7 +1105,7 @@ static struct inode *find_inode_fast(struct super_block *sb,
 			continue;
 		spin_lock(&inode->i_lock);
 		if (inode_state_read(inode) & (I_FREEING | I_WILL_FREE)) {
-			__wait_on_freeing_inode(inode, hash_locked, true);
+			__wait_on_freeing_inode(inode, is_inode_hash_locked);
 			goto repeat;
 		}
 		if (unlikely(inode_state_read(inode) & I_CREATING)) {
@@ -1842,13 +1841,28 @@ int insert_inode_locked(struct inode *inode)
 	while (1) {
 		struct inode *old = NULL;
 		spin_lock(&inode_hash_lock);
-repeat:
 		hlist_for_each_entry(old, head, i_hash) {
 			if (old->i_ino != ino)
 				continue;
 			if (old->i_sb != sb)
 				continue;
 			spin_lock(&old->i_lock);
+			/*
+			 * FIXME: inodes awaiting eviction don't get waited for
+			 *
+			 * This is a bug because the hash can temporarily end up with duplicate inodes.
+			 * It happens to work becuase new inodes are inserted at the beginning of the
+			 * chain, meaning they will be found first should anyone do a lookup.
+			 *
+			 * Fixing the above results in deadlocks in ext4 due to journal handling during
+			 * inode creation and eviction -- the eviction side waits for creation side to
+			 * finish. Adding __wait_on_freeing_inode results in both sides waiting on each
+			 * other.
+			 */
+			if (inode_state_read(old) & (I_FREEING | I_WILL_FREE)) {
+				spin_unlock(&old->i_lock);
+				continue;
+			}
 			break;
 		}
 		if (likely(!old)) {
@@ -1859,11 +1873,6 @@ int insert_inode_locked(struct inode *inode)
 			spin_unlock(&inode_hash_lock);
 			return 0;
 		}
-		if (inode_state_read(old) & (I_FREEING | I_WILL_FREE)) {
-			__wait_on_freeing_inode(old, true, false);
-			old = NULL;
-			goto repeat;
-		}
 		if (unlikely(inode_state_read(old) & I_CREATING)) {
 			spin_unlock(&old->i_lock);
 			spin_unlock(&inode_hash_lock);
@@ -2534,18 +2543,16 @@ EXPORT_SYMBOL(inode_needs_sync);
  * wake_up_bit(&inode->i_state, __I_NEW) after removing from the hash list
  * will DTRT.
  */
-static void __wait_on_freeing_inode(struct inode *inode, bool hash_locked, bool rcu_locked)
+static void __wait_on_freeing_inode(struct inode *inode, bool is_inode_hash_locked)
 {
 	struct wait_bit_queue_entry wqe;
 	struct wait_queue_head *wq_head;
 
-	VFS_BUG_ON(!hash_locked && !rcu_locked);
-
 	/*
 	 * Handle racing against evict(), see that routine for more details.
 	 */
 	if (unlikely(inode_unhashed(inode))) {
-		WARN_ON(hash_locked);
+		WARN_ON(is_inode_hash_locked);
 		spin_unlock(&inode->i_lock);
 		return;
 	}
@@ -2553,16 +2560,14 @@ static void __wait_on_freeing_inode(struct inode *inode, bool hash_locked, bool
 	wq_head = inode_bit_waitqueue(&wqe, inode, __I_NEW);
 	prepare_to_wait_event(wq_head, &wqe.wq_entry, TASK_UNINTERRUPTIBLE);
 	spin_unlock(&inode->i_lock);
-	if (rcu_locked)
-		rcu_read_unlock();
-	if (hash_locked)
+	rcu_read_unlock();
+	if (is_inode_hash_locked)
 		spin_unlock(&inode_hash_lock);
 	schedule();
 	finish_wait(wq_head, &wqe.wq_entry);
-	if (hash_locked)
+	if (is_inode_hash_locked)
 		spin_lock(&inode_hash_lock);
-	if (rcu_locked)
-		rcu_read_lock();
+	rcu_read_lock();
 }
 
 static __initdata unsigned long ihash_entries;
-- 
2.48.1


^ permalink raw reply	[flat|nested] 15+ messages in thread
end of thread, other threads:[~2026-03-28 15:33 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-03-28 15:31 [PATCH 0/5] assorted ->i_count-related changes Mateusz Guzik
2026-03-28 15:31 ` [PATCH 1/5] fs: add icount_read_once() Mateusz Guzik
2026-03-28 15:31 ` [PATCH] fs: revert insert_inode_locked() eviction wait change and explain why Mateusz Guzik
2026-03-28 15:33   ` Mateusz Guzik
2026-03-28 15:31 ` [PATCH 2/5] Use icount_read() and icount_read_once() as appropriate Mateusz Guzik
2026-03-28 15:31 ` [PATCH 3/5] fs: enforce locking in icount_read(), add some commentary Mateusz Guzik
2026-03-28 15:31 ` [PATCH 4/5] fs: handle hypothetical filesystems hich use I_DONTCACHE and drop the lock in ->drop_inode Mateusz Guzik
2026-03-28 15:31 ` [PATCH 5/5] fs: locklessly bump refs in igrab as long as it does not transition 0->1 Mateusz Guzik
  -- strict thread matches above, loose matches on Subject: below --
2026-03-16 10:33 [PATCH] fs: revert insert_inode_locked() eviction wait change and explain why Mateusz Guzik
2026-03-17 13:01 ` Jan Kara
2026-03-17 13:12   ` Mateusz Guzik
2026-03-17 13:39     ` Jan Kara
2026-03-17 13:44       ` Mateusz Guzik
2026-03-19 13:05         ` Jan Kara
2026-03-20  9:30           ` Jan Kara

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®