* [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir()
@ 2026-08-27 12:50 Sergey Senozhatsky
2026-08-27 13:41 ` Jan Kara
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Sergey Senozhatsky @ 2026-08-27 12:50 UTC (permalink / raw)
To: Theodore Ts'o, Andreas Dilger, Baokun Li, Jan Kara
Cc: Ojaswin Mujoo, Ritesh Harjani (IBM),
Zhang Yi, linux-ext4, linux-kernel, Sergey Senozhatsky,
Sarthak Kukreti
We observe the following ABBA deadlock (casefolding enabled):
INFO: task jbd2/dm-13-8:447 blocked for more than 720 seconds.
task:jbd2/dm-13-8 state:D stack:0 pid:447 tgid:447 ppid:2
Call Trace:
<TASK>
__schedule+0xc2c/0xe60
schedule+0x40/0xe0
jbd2_journal_wait_updates+0x8f/0xf0
jbd2_journal_commit_transaction+0x321/0x1850
kjournald2+0xa9/0x230
kthread+0x226/0x2a0
ret_from_fork+0x101/0x1e0
ret_from_fork_asm+0x1a/0x30
INFO: task Thread-10:4161 blocked for more than 720 seconds.
task:Thread-10 state:D stack:0 pid:4161 tgid:3848 ppid:540
Call Trace:
<TASK>
__schedule+0xc2c/0xe60
schedule+0x40/0xe0
wait_transaction_locked+0x8c/0xd0
start_this_handle+0x252/0x870
jbd2__journal_start+0x120/0x280
__ext4_journal_start_sb+0x11a/0x250
ext4_evict_inode+0x208/0x760
iput+0x222/0x5c0
dput+0x293/0x690
____fput+0x145/0x2b0
task_work_run+0x7a/0xb0
exit_to_user_mode_loop+0xc0/0xd0
do_syscall_64+0x14b/0xf10
entry_SYSCALL_64_after_hwframe+0x76/0x7e
NMI backtrace for cpu 0
CPU: 0 UID: 1010216 PID: 4160 Comm: Thread-7
RIP: 0010:d_walk+0x0/0x290
[..]
Call Trace:
<TASK>
shrink_dcache_parent+0xb2/0x100
d_invalidate+0x50/0x110
ext4_rmdir+0x3a2/0x3d0
vfs_rmdir+0x9d/0x1d0
do_rmdir+0xf0/0x330
__x64_sys_unlinkat+0x34/0x50
do_syscall_64+0x61/0xf10
The problem is that ext4_rmdir() calls d_invalidate() before stopping
the jbd2 transaction handle. Because d_invalidate() traverses child
dentries it can encounter dying or in-use dentries. If a concurrent
thread executing __dentry_kill() on a child dentry invokes ext4_evict_inode(),
it requests a new transaction handle via ext4_journal_start(), which
waits for all running handles to close. However, the thread executing
ext4_rmdir() still holds its active transaction handle while looping
in shrink_dcache_parent() waiting for the dying child dentry to complete
eviction.
Stop transaction handle in ext4_rmdir() before calling d_invalidate().
Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
Co-developed-by: Sarthak Kukreti <sarthakkukreti@google.com>
Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
---
fs/ext4/namei.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index a6386c1d237f..231a274b814e 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3209,19 +3209,20 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
ext4_fc_track_unlink(handle, dentry);
retval = ext4_mark_inode_dirty(handle, dir);
+end_rmdir:
+ brelse(bh);
+ if (handle)
+ ext4_journal_stop(handle);
+
/* VFS negative dentries are incompatible with Encoding and
* Case-insensitiveness. Eventually we'll want avoid
* invalidating the dentries here, alongside with returning the
* negative dentries at ext4_lookup(), when it is better
* supported by the VFS for the CI case.
*/
- if (IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
+ if (!retval && IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
d_invalidate(dentry);
-end_rmdir:
- brelse(bh);
- if (handle)
- ext4_journal_stop(handle);
return retval;
}
--
2.55.0.897.gb25b4bd76c-goog
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir()
2026-08-27 12:50 [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir() Sergey Senozhatsky
@ 2026-08-27 13:41 ` Jan Kara
2026-08-28 4:03 ` Sergey Senozhatsky
2026-08-28 2:48 ` Baokun Li
2026-08-29 9:53 ` Zhang Yi
2 siblings, 1 reply; 6+ messages in thread
From: Jan Kara @ 2026-08-27 13:41 UTC (permalink / raw)
To: Sergey Senozhatsky
Cc: Theodore Ts'o, Andreas Dilger, Baokun Li, Jan Kara,
Ojaswin Mujoo, Ritesh Harjani (IBM),
Zhang Yi, linux-ext4, linux-kernel, Sarthak Kukreti
On Thu 27-08-26 21:50:20, Sergey Senozhatsky wrote:
> We observe the following ABBA deadlock (casefolding enabled):
>
> INFO: task jbd2/dm-13-8:447 blocked for more than 720 seconds.
> task:jbd2/dm-13-8 state:D stack:0 pid:447 tgid:447 ppid:2
> Call Trace:
> <TASK>
> __schedule+0xc2c/0xe60
> schedule+0x40/0xe0
> jbd2_journal_wait_updates+0x8f/0xf0
> jbd2_journal_commit_transaction+0x321/0x1850
> kjournald2+0xa9/0x230
> kthread+0x226/0x2a0
> ret_from_fork+0x101/0x1e0
> ret_from_fork_asm+0x1a/0x30
>
> INFO: task Thread-10:4161 blocked for more than 720 seconds.
> task:Thread-10 state:D stack:0 pid:4161 tgid:3848 ppid:540
> Call Trace:
> <TASK>
> __schedule+0xc2c/0xe60
> schedule+0x40/0xe0
> wait_transaction_locked+0x8c/0xd0
> start_this_handle+0x252/0x870
> jbd2__journal_start+0x120/0x280
> __ext4_journal_start_sb+0x11a/0x250
> ext4_evict_inode+0x208/0x760
> iput+0x222/0x5c0
> dput+0x293/0x690
> ____fput+0x145/0x2b0
> task_work_run+0x7a/0xb0
> exit_to_user_mode_loop+0xc0/0xd0
> do_syscall_64+0x14b/0xf10
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> NMI backtrace for cpu 0
> CPU: 0 UID: 1010216 PID: 4160 Comm: Thread-7
> RIP: 0010:d_walk+0x0/0x290
> [..]
> Call Trace:
> <TASK>
> shrink_dcache_parent+0xb2/0x100
> d_invalidate+0x50/0x110
> ext4_rmdir+0x3a2/0x3d0
> vfs_rmdir+0x9d/0x1d0
> do_rmdir+0xf0/0x330
> __x64_sys_unlinkat+0x34/0x50
> do_syscall_64+0x61/0xf10
>
> The problem is that ext4_rmdir() calls d_invalidate() before stopping
> the jbd2 transaction handle. Because d_invalidate() traverses child
> dentries it can encounter dying or in-use dentries. If a concurrent
> thread executing __dentry_kill() on a child dentry invokes ext4_evict_inode(),
> it requests a new transaction handle via ext4_journal_start(), which
> waits for all running handles to close. However, the thread executing
> ext4_rmdir() still holds its active transaction handle while looping
> in shrink_dcache_parent() waiting for the dying child dentry to complete
> eviction.
>
> Stop transaction handle in ext4_rmdir() before calling d_invalidate().
>
> Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
> Co-developed-by: Sarthak Kukreti <sarthakkukreti@google.com>
> Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
> Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Good catch! Feel free to add:
Reviewed-by: Jan Kara <jack@suse.cz>
Honza
> ---
> fs/ext4/namei.c | 11 ++++++-----
> 1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
> index a6386c1d237f..231a274b814e 100644
> --- a/fs/ext4/namei.c
> +++ b/fs/ext4/namei.c
> @@ -3209,19 +3209,20 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
> ext4_fc_track_unlink(handle, dentry);
> retval = ext4_mark_inode_dirty(handle, dir);
>
> +end_rmdir:
> + brelse(bh);
> + if (handle)
> + ext4_journal_stop(handle);
> +
> /* VFS negative dentries are incompatible with Encoding and
> * Case-insensitiveness. Eventually we'll want avoid
> * invalidating the dentries here, alongside with returning the
> * negative dentries at ext4_lookup(), when it is better
> * supported by the VFS for the CI case.
> */
> - if (IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
> + if (!retval && IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
> d_invalidate(dentry);
>
> -end_rmdir:
> - brelse(bh);
> - if (handle)
> - ext4_journal_stop(handle);
> return retval;
> }
>
> --
> 2.55.0.897.gb25b4bd76c-goog
>
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir()
2026-08-27 13:41 ` Jan Kara
@ 2026-08-28 4:03 ` Sergey Senozhatsky
0 siblings, 0 replies; 6+ messages in thread
From: Sergey Senozhatsky @ 2026-08-28 4:03 UTC (permalink / raw)
To: Jan Kara
Cc: Sergey Senozhatsky, Theodore Ts'o, Andreas Dilger, Baokun Li,
Ojaswin Mujoo, Ritesh Harjani (IBM),
Zhang Yi, linux-ext4, linux-kernel, Sarthak Kukreti
On (26/08/27 15:41), Jan Kara wrote:
> On Thu 27-08-26 21:50:20, Sergey Senozhatsky wrote:
> > We observe the following ABBA deadlock (casefolding enabled):
> >
> > INFO: task jbd2/dm-13-8:447 blocked for more than 720 seconds.
> > task:jbd2/dm-13-8 state:D stack:0 pid:447 tgid:447 ppid:2
> > Call Trace:
> > <TASK>
> > __schedule+0xc2c/0xe60
> > schedule+0x40/0xe0
> > jbd2_journal_wait_updates+0x8f/0xf0
> > jbd2_journal_commit_transaction+0x321/0x1850
> > kjournald2+0xa9/0x230
> > kthread+0x226/0x2a0
> > ret_from_fork+0x101/0x1e0
> > ret_from_fork_asm+0x1a/0x30
> >
> > INFO: task Thread-10:4161 blocked for more than 720 seconds.
> > task:Thread-10 state:D stack:0 pid:4161 tgid:3848 ppid:540
> > Call Trace:
> > <TASK>
> > __schedule+0xc2c/0xe60
> > schedule+0x40/0xe0
> > wait_transaction_locked+0x8c/0xd0
> > start_this_handle+0x252/0x870
> > jbd2__journal_start+0x120/0x280
> > __ext4_journal_start_sb+0x11a/0x250
> > ext4_evict_inode+0x208/0x760
> > iput+0x222/0x5c0
> > dput+0x293/0x690
> > ____fput+0x145/0x2b0
> > task_work_run+0x7a/0xb0
> > exit_to_user_mode_loop+0xc0/0xd0
> > do_syscall_64+0x14b/0xf10
> > entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >
> > NMI backtrace for cpu 0
> > CPU: 0 UID: 1010216 PID: 4160 Comm: Thread-7
> > RIP: 0010:d_walk+0x0/0x290
> > [..]
> > Call Trace:
> > <TASK>
> > shrink_dcache_parent+0xb2/0x100
> > d_invalidate+0x50/0x110
> > ext4_rmdir+0x3a2/0x3d0
> > vfs_rmdir+0x9d/0x1d0
> > do_rmdir+0xf0/0x330
> > __x64_sys_unlinkat+0x34/0x50
> > do_syscall_64+0x61/0xf10
> >
> > The problem is that ext4_rmdir() calls d_invalidate() before stopping
> > the jbd2 transaction handle. Because d_invalidate() traverses child
> > dentries it can encounter dying or in-use dentries. If a concurrent
> > thread executing __dentry_kill() on a child dentry invokes ext4_evict_inode(),
> > it requests a new transaction handle via ext4_journal_start(), which
> > waits for all running handles to close. However, the thread executing
> > ext4_rmdir() still holds its active transaction handle while looping
> > in shrink_dcache_parent() waiting for the dying child dentry to complete
> > eviction.
> >
> > Stop transaction handle in ext4_rmdir() before calling d_invalidate().
> >
> > Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
> > Co-developed-by: Sarthak Kukreti <sarthakkukreti@google.com>
> > Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
> > Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
>
> Good catch! Feel free to add:
>
> Reviewed-by: Jan Kara <jack@suse.cz>
Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir()
2026-08-27 12:50 [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir() Sergey Senozhatsky
2026-08-27 13:41 ` Jan Kara
@ 2026-08-28 2:48 ` Baokun Li
2026-08-28 4:03 ` Sergey Senozhatsky
2026-08-29 9:53 ` Zhang Yi
2 siblings, 1 reply; 6+ messages in thread
From: Baokun Li @ 2026-08-28 2:48 UTC (permalink / raw)
To: Sergey Senozhatsky
Cc: Theodore Ts'o, Jan Kara, Andreas Dilger, Ojaswin Mujoo,
Ritesh Harjani (IBM),
Zhang Yi, linux-ext4, linux-kernel, Sarthak Kukreti
On 2026/8/27 20:50, Sergey Senozhatsky wrote:
> We observe the following ABBA deadlock (casefolding enabled):
>
> INFO: task jbd2/dm-13-8:447 blocked for more than 720 seconds.
> task:jbd2/dm-13-8 state:D stack:0 pid:447 tgid:447 ppid:2
> Call Trace:
> <TASK>
> __schedule+0xc2c/0xe60
> schedule+0x40/0xe0
> jbd2_journal_wait_updates+0x8f/0xf0
> jbd2_journal_commit_transaction+0x321/0x1850
> kjournald2+0xa9/0x230
> kthread+0x226/0x2a0
> ret_from_fork+0x101/0x1e0
> ret_from_fork_asm+0x1a/0x30
>
> INFO: task Thread-10:4161 blocked for more than 720 seconds.
> task:Thread-10 state:D stack:0 pid:4161 tgid:3848 ppid:540
> Call Trace:
> <TASK>
> __schedule+0xc2c/0xe60
> schedule+0x40/0xe0
> wait_transaction_locked+0x8c/0xd0
> start_this_handle+0x252/0x870
> jbd2__journal_start+0x120/0x280
> __ext4_journal_start_sb+0x11a/0x250
> ext4_evict_inode+0x208/0x760
> iput+0x222/0x5c0
> dput+0x293/0x690
> ____fput+0x145/0x2b0
> task_work_run+0x7a/0xb0
> exit_to_user_mode_loop+0xc0/0xd0
> do_syscall_64+0x14b/0xf10
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> NMI backtrace for cpu 0
> CPU: 0 UID: 1010216 PID: 4160 Comm: Thread-7
> RIP: 0010:d_walk+0x0/0x290
> [..]
> Call Trace:
> <TASK>
> shrink_dcache_parent+0xb2/0x100
> d_invalidate+0x50/0x110
> ext4_rmdir+0x3a2/0x3d0
> vfs_rmdir+0x9d/0x1d0
> do_rmdir+0xf0/0x330
> __x64_sys_unlinkat+0x34/0x50
> do_syscall_64+0x61/0xf10
>
> The problem is that ext4_rmdir() calls d_invalidate() before stopping
> the jbd2 transaction handle. Because d_invalidate() traverses child
> dentries it can encounter dying or in-use dentries. If a concurrent
> thread executing __dentry_kill() on a child dentry invokes ext4_evict_inode(),
> it requests a new transaction handle via ext4_journal_start(), which
> waits for all running handles to close. However, the thread executing
> ext4_rmdir() still holds its active transaction handle while looping
> in shrink_dcache_parent() waiting for the dying child dentry to complete
> eviction.
>
> Stop transaction handle in ext4_rmdir() before calling d_invalidate().
>
> Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
> Co-developed-by: Sarthak Kukreti <sarthakkukreti@google.com>
> Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
> Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Looks good!
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
> ---
> fs/ext4/namei.c | 11 ++++++-----
> 1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
> index a6386c1d237f..231a274b814e 100644
> --- a/fs/ext4/namei.c
> +++ b/fs/ext4/namei.c
> @@ -3209,19 +3209,20 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
> ext4_fc_track_unlink(handle, dentry);
> retval = ext4_mark_inode_dirty(handle, dir);
>
> +end_rmdir:
> + brelse(bh);
> + if (handle)
> + ext4_journal_stop(handle);
> +
> /* VFS negative dentries are incompatible with Encoding and
> * Case-insensitiveness. Eventually we'll want avoid
> * invalidating the dentries here, alongside with returning the
> * negative dentries at ext4_lookup(), when it is better
> * supported by the VFS for the CI case.
> */
> - if (IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
> + if (!retval && IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
> d_invalidate(dentry);
>
> -end_rmdir:
> - brelse(bh);
> - if (handle)
> - ext4_journal_stop(handle);
> return retval;
> }
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir()
2026-08-28 2:48 ` Baokun Li
@ 2026-08-28 4:03 ` Sergey Senozhatsky
0 siblings, 0 replies; 6+ messages in thread
From: Sergey Senozhatsky @ 2026-08-28 4:03 UTC (permalink / raw)
To: Baokun Li
Cc: Sergey Senozhatsky, Theodore Ts'o, Jan Kara, Andreas Dilger,
Ojaswin Mujoo, Ritesh Harjani (IBM),
Zhang Yi, linux-ext4, linux-kernel, Sarthak Kukreti
On (26/08/28 10:48), Baokun Li wrote:
> On 2026/8/27 20:50, Sergey Senozhatsky wrote:
> > We observe the following ABBA deadlock (casefolding enabled):
> >
> > INFO: task jbd2/dm-13-8:447 blocked for more than 720 seconds.
> > task:jbd2/dm-13-8 state:D stack:0 pid:447 tgid:447 ppid:2
> > Call Trace:
> > <TASK>
> > __schedule+0xc2c/0xe60
> > schedule+0x40/0xe0
> > jbd2_journal_wait_updates+0x8f/0xf0
> > jbd2_journal_commit_transaction+0x321/0x1850
> > kjournald2+0xa9/0x230
> > kthread+0x226/0x2a0
> > ret_from_fork+0x101/0x1e0
> > ret_from_fork_asm+0x1a/0x30
> >
> > INFO: task Thread-10:4161 blocked for more than 720 seconds.
> > task:Thread-10 state:D stack:0 pid:4161 tgid:3848 ppid:540
> > Call Trace:
> > <TASK>
> > __schedule+0xc2c/0xe60
> > schedule+0x40/0xe0
> > wait_transaction_locked+0x8c/0xd0
> > start_this_handle+0x252/0x870
> > jbd2__journal_start+0x120/0x280
> > __ext4_journal_start_sb+0x11a/0x250
> > ext4_evict_inode+0x208/0x760
> > iput+0x222/0x5c0
> > dput+0x293/0x690
> > ____fput+0x145/0x2b0
> > task_work_run+0x7a/0xb0
> > exit_to_user_mode_loop+0xc0/0xd0
> > do_syscall_64+0x14b/0xf10
> > entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >
> > NMI backtrace for cpu 0
> > CPU: 0 UID: 1010216 PID: 4160 Comm: Thread-7
> > RIP: 0010:d_walk+0x0/0x290
> > [..]
> > Call Trace:
> > <TASK>
> > shrink_dcache_parent+0xb2/0x100
> > d_invalidate+0x50/0x110
> > ext4_rmdir+0x3a2/0x3d0
> > vfs_rmdir+0x9d/0x1d0
> > do_rmdir+0xf0/0x330
> > __x64_sys_unlinkat+0x34/0x50
> > do_syscall_64+0x61/0xf10
> >
> > The problem is that ext4_rmdir() calls d_invalidate() before stopping
> > the jbd2 transaction handle. Because d_invalidate() traverses child
> > dentries it can encounter dying or in-use dentries. If a concurrent
> > thread executing __dentry_kill() on a child dentry invokes ext4_evict_inode(),
> > it requests a new transaction handle via ext4_journal_start(), which
> > waits for all running handles to close. However, the thread executing
> > ext4_rmdir() still holds its active transaction handle while looping
> > in shrink_dcache_parent() waiting for the dying child dentry to complete
> > eviction.
> >
> > Stop transaction handle in ext4_rmdir() before calling d_invalidate().
> >
> > Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
> > Co-developed-by: Sarthak Kukreti <sarthakkukreti@google.com>
> > Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
> > Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
>
> Looks good!
>
> Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir()
2026-08-27 12:50 [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir() Sergey Senozhatsky
2026-08-27 13:41 ` Jan Kara
2026-08-28 2:48 ` Baokun Li
@ 2026-08-29 9:53 ` Zhang Yi
2 siblings, 0 replies; 6+ messages in thread
From: Zhang Yi @ 2026-08-29 9:53 UTC (permalink / raw)
To: Sergey Senozhatsky
Cc: Theodore Ts'o, Andreas Dilger, Baokun Li, Jan Kara,
Ojaswin Mujoo, Ritesh Harjani (IBM),
linux-ext4, linux-kernel, Sarthak Kukreti
On 8/27/2026 8:50 PM, Sergey Senozhatsky wrote:
> We observe the following ABBA deadlock (casefolding enabled):
>
> INFO: task jbd2/dm-13-8:447 blocked for more than 720 seconds.
> task:jbd2/dm-13-8 state:D stack:0 pid:447 tgid:447 ppid:2
> Call Trace:
> <TASK>
> __schedule+0xc2c/0xe60
> schedule+0x40/0xe0
> jbd2_journal_wait_updates+0x8f/0xf0
> jbd2_journal_commit_transaction+0x321/0x1850
> kjournald2+0xa9/0x230
> kthread+0x226/0x2a0
> ret_from_fork+0x101/0x1e0
> ret_from_fork_asm+0x1a/0x30
>
> INFO: task Thread-10:4161 blocked for more than 720 seconds.
> task:Thread-10 state:D stack:0 pid:4161 tgid:3848 ppid:540
> Call Trace:
> <TASK>
> __schedule+0xc2c/0xe60
> schedule+0x40/0xe0
> wait_transaction_locked+0x8c/0xd0
> start_this_handle+0x252/0x870
> jbd2__journal_start+0x120/0x280
> __ext4_journal_start_sb+0x11a/0x250
> ext4_evict_inode+0x208/0x760
> iput+0x222/0x5c0
> dput+0x293/0x690
> ____fput+0x145/0x2b0
> task_work_run+0x7a/0xb0
> exit_to_user_mode_loop+0xc0/0xd0
> do_syscall_64+0x14b/0xf10
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> NMI backtrace for cpu 0
> CPU: 0 UID: 1010216 PID: 4160 Comm: Thread-7
> RIP: 0010:d_walk+0x0/0x290
> [..]
> Call Trace:
> <TASK>
> shrink_dcache_parent+0xb2/0x100
> d_invalidate+0x50/0x110
> ext4_rmdir+0x3a2/0x3d0
> vfs_rmdir+0x9d/0x1d0
> do_rmdir+0xf0/0x330
> __x64_sys_unlinkat+0x34/0x50
> do_syscall_64+0x61/0xf10
>
> The problem is that ext4_rmdir() calls d_invalidate() before stopping
> the jbd2 transaction handle. Because d_invalidate() traverses child
> dentries it can encounter dying or in-use dentries. If a concurrent
> thread executing __dentry_kill() on a child dentry invokes ext4_evict_inode(),
> it requests a new transaction handle via ext4_journal_start(), which
> waits for all running handles to close. However, the thread executing
> ext4_rmdir() still holds its active transaction handle while looping
> in shrink_dcache_parent() waiting for the dying child dentry to complete
> eviction.
>
> Stop transaction handle in ext4_rmdir() before calling d_invalidate().
>
> Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
> Co-developed-by: Sarthak Kukreti <sarthakkukreti@google.com>
> Signed-off-by: Sarthak Kukreti <sarthakkukreti@google.com>
> Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Thank you for the fix patch, this issue is quite subtle.
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
> ---
> fs/ext4/namei.c | 11 ++++++-----
> 1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
> index a6386c1d237f..231a274b814e 100644
> --- a/fs/ext4/namei.c
> +++ b/fs/ext4/namei.c
> @@ -3209,19 +3209,20 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
> ext4_fc_track_unlink(handle, dentry);
> retval = ext4_mark_inode_dirty(handle, dir);
>
> +end_rmdir:
> + brelse(bh);
> + if (handle)
> + ext4_journal_stop(handle);
> +
> /* VFS negative dentries are incompatible with Encoding and
> * Case-insensitiveness. Eventually we'll want avoid
> * invalidating the dentries here, alongside with returning the
> * negative dentries at ext4_lookup(), when it is better
> * supported by the VFS for the CI case.
> */
> - if (IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
> + if (!retval && IS_ENABLED(CONFIG_UNICODE) && IS_CASEFOLDED(dir))
> d_invalidate(dentry);
>
> -end_rmdir:
> - brelse(bh);
> - if (handle)
> - ext4_journal_stop(handle);
> return retval;
> }
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-29 9:53 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-27 12:50 [PATCH] fs/ext4: fix ABBA deadlock in ext4_rmdir() Sergey Senozhatsky
2026-08-27 13:41 ` Jan Kara
2026-08-28 4:03 ` Sergey Senozhatsky
2026-08-28 2:48 ` Baokun Li
2026-08-28 4:03 ` Sergey Senozhatsky
2026-08-29 9:53 ` Zhang Yi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®