[PATCH v2] btrfs: Clean up delayed inode items on transaction abort

[PATCH v2] btrfs: Clean up delayed inode items on transaction abort

[pavankumaryalagada]

From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>

When a transaction is aborted, btrfs_commit_inode_delayed_inode()
fails because btrfs_join_transaction() returns an error. This makes
btrfs_evict_inode() skip btrfs_kill_delayed_inode_items(), leaving
pending items in the delayed node.

Clean up delayed inode items when the transaction is aborted, even
if btrfs_commit_inode_delayed_inode() returns an error.

Reported-by: syzbot+55d1814e49f1fc0ba542@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6af131f2.44d55313.247daf.0001.GAE@google.com/T/
Fixes: 2adc75d61203 ("btrfs: move btrfs_kill_delayed_inode_items into evict")
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
---
v2:
- Add a condition to call btrfs_kill_delayed_inode_items() when the
  transaction is aborted, even if the inode update fails.

v1: https://lore.kernel.org/linux-btrfs/avMkGGHSH2scfa0t@user/T/#t
---
 fs/btrfs/inode.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index abaa33471456..b3a33541b8c8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5623,16 +5623,21 @@ void btrfs_evict_inode(struct inode *inode)
 	 * the inode update is released.
 	 */
 	ret = btrfs_commit_inode_delayed_inode(BTRFS_I(inode));
-	if (ret)
-		goto out;
 
 	/*
 	 * This drops any pending insert or delete operations we have for this
 	 * inode.  We could have a delayed dir index deletion queued up, but
 	 * we're removing the inode completely so that'll be taken care of in
 	 * the truncate.
+	 *
+	 * We must also clean up delayed inode items when the transaction is
+	 * aborted.
 	 */
-	btrfs_kill_delayed_inode_items(BTRFS_I(inode));
+	if (!ret || test_bit(BTRFS_FS_STATE_TRANS_ABORTED, &fs_info->fs_state))
+		btrfs_kill_delayed_inode_items(BTRFS_I(inode));
+
+	if (ret)
+		goto out;
 
 	btrfs_init_metadata_block_rsv(fs_info, &rsv, BTRFS_BLOCK_RSV_TEMP);
 	rsv.size = btrfs_calc_metadata_size(fs_info, 1);
-- 
2.43.0