[PATCH] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()

[PATCH] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()

[Ryusuke Konishi]

Syzbot reported a deadlock between nilfs_evict_inode(), executed via
an asynchronous workqueue (kworker) as:

  process_one_work()
    process_scheduled_works()
      nilfs_iput_work_func()
        nilfs_dispose_list()
          iput()
            iput_final()
              evict()
                s_op->evict_inode()
                  nilfs_evict_inode()

and find_inode(), called via

  nilfs_mkdir()
    nilfs_new_inode()
      nilfs_insert_inode_locked()
        insert_inode_locked4()
          inode_insert5()
            find_inode()

When an inode is deleted (i_nlink == 0), nilfs_evict_inode() clears its
ifile bitmap entry and then synchronously triggers the log writer via
nilfs_transaction_commit() if IS_SYNC(inode) is true.

If a concurrent directory creation via nilfs_new_inode() attempts to
allocate the same newly freed inode number, however, find_inode() called
just before inserting it into the inode hash, blocks waiting for the old
inode's evict() to complete.

Meanwhile, the synchronous log writer invoked from nilfs_evict_inode()
tries to acquire a write lock on 'ns_segctor_sem' which is read locked
by the caller of nilfs_new_inode() (in this case, nilfs_mkdir()),
resulting in a deadlock.

The synchronous log writer invocation from nilfs_evict_inode() is a
legacy artifact; it is no longer necessary because the call itself
(triggered by iput()) is now handled asynchronously with a kworker
if i_nlink == 0.  It merely increases the risk of deadlock.

Fix this deadlock by removing the synchronous log writer trigger from
nilfs_evict_inode().

Reported-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6646318bbcf419411bc5
Fixes: 7ef3ff2fea8b ("nilfs2: fix deadlock of segment constructor over I_SYNC flag")
Tested-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
---
Hi Viacheslav,

Please apply this bug fix.

This fixes a deadlock issue that had been reported by syzbot but
remained unresolved for over a year.

Thanks,
Ryusuke Konishi

 fs/nilfs2/inode.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 64437aed8390..33490e8063eb 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -895,13 +895,7 @@ void nilfs_evict_inode(struct inode *inode)
 
 	nilfs_clear_inode(inode);
 
-	if (IS_SYNC(inode))
-		nilfs_set_transaction_flag(NILFS_TI_SYNC);
 	nilfs_transaction_commit(sb);
-	/*
-	 * May construct a logical segment and may fail in sync mode.
-	 * But delete_inode has no return value.
-	 */
 }
 
 int nilfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
-- 
2.53.0

Re: [PATCH] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()

[Viacheslav Dubeyko]

On Thu, 2026-09-24 at 01:41 +0900, Ryusuke Konishi wrote:
> Syzbot reported a deadlock between nilfs_evict_inode(), executed via
> an asynchronous workqueue (kworker) as:
> 
>   process_one_work()
>     process_scheduled_works()
>       nilfs_iput_work_func()
>         nilfs_dispose_list()
>           iput()
>             iput_final()
>               evict()
>                 s_op->evict_inode()
>                   nilfs_evict_inode()
> 
> and find_inode(), called via
> 
>   nilfs_mkdir()
>     nilfs_new_inode()
>       nilfs_insert_inode_locked()
>         insert_inode_locked4()
>           inode_insert5()
>             find_inode()
> 
> When an inode is deleted (i_nlink == 0), nilfs_evict_inode() clears
> its
> ifile bitmap entry and then synchronously triggers the log writer via
> nilfs_transaction_commit() if IS_SYNC(inode) is true.
> 
> If a concurrent directory creation via nilfs_new_inode() attempts to
> allocate the same newly freed inode number, however, find_inode()
> called
> just before inserting it into the inode hash, blocks waiting for the
> old
> inode's evict() to complete.
> 
> Meanwhile, the synchronous log writer invoked from
> nilfs_evict_inode()
> tries to acquire a write lock on 'ns_segctor_sem' which is read
> locked
> by the caller of nilfs_new_inode() (in this case, nilfs_mkdir()),
> resulting in a deadlock.
> 
> The synchronous log writer invocation from nilfs_evict_inode() is a
> legacy artifact; it is no longer necessary because the call itself
> (triggered by iput()) is now handled asynchronously with a kworker
> if i_nlink == 0.  It merely increases the risk of deadlock.
> 
> Fix this deadlock by removing the synchronous log writer trigger from
> nilfs_evict_inode().
> 
> Reported-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=6646318bbcf419411bc5
> Fixes: 7ef3ff2fea8b ("nilfs2: fix deadlock of segment constructor
> over I_SYNC flag")
> Tested-by: syzbot+6646318bbcf419411bc5@syzkaller.appspotmail.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
> ---
> Hi Viacheslav,
> 
> Please apply this bug fix.
> 
> This fixes a deadlock issue that had been reported by syzbot but
> remained unresolved for over a year.
> 
> Thanks,
> Ryusuke Konishi
> 
>  fs/nilfs2/inode.c | 6 ------
>  1 file changed, 6 deletions(-)
> 
> diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
> index 64437aed8390..33490e8063eb 100644
> --- a/fs/nilfs2/inode.c
> +++ b/fs/nilfs2/inode.c
> @@ -895,13 +895,7 @@ void nilfs_evict_inode(struct inode *inode)
>  
>  	nilfs_clear_inode(inode);
>  
> -	if (IS_SYNC(inode))
> -		nilfs_set_transaction_flag(NILFS_TI_SYNC);
>  	nilfs_transaction_commit(sb);
> -	/*
> -	 * May construct a logical segment and may fail in sync
> mode.
> -	 * But delete_inode has no return value.
> -	 */
>  }
>  
>  int nilfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,

Applied.

Thanks,
Slava.