From:   Jia-Ju Bai <baijiaju1990@gmail.com>
Subject: [BUG] fs: btrfs: several possible ABBA deadlocks
To:     clm@fb.com, josef@toxicpanda.com, dsterba@suse.com
Cc:     linux-btrfs@vger.kernel.org,
        linux-kernel <linux-kernel@vger.kernel.org>
Message-ID: <44b385ca-f00d-0b47-e370-bd7d97cb1be3@gmail.com>
Date:   Sat, 27 Nov 2021 16:23:37 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.4.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Precedence: bulk

Hello,

My static analysis tool reports several possible ABBA deadlocks in the 
btrfs module in Linux 5.10:

# DEADLOCK 1:
__clear_extent_bit()
   spin_lock(&tree->lock); --> Line 733 (Lock A)
   split_state()
     btrfs_split_delalloc_extent()
       spin_lock(&BTRFS_I(inode)->lock); --> Line 1870 (Lock B)

btrfs_inode_safe_disk_i_size_write()
   spin_lock(&BTRFS_I(inode)->lock); --> Line 53 (Lock B)
   find_contiguous_extent_bit()
     spin_lock(&tree->lock); --> Line 1620 (Lock A)

When __clear_extent_bit() and btrfs_inode_safe_disk_i_size_write() are 
concurrently executed, the deadlock can occur.

# DEADLOCK 2:
__set_extent_bit()
   spin_lock(&tree->lock); --> Line 995 (Lock A)
   set_state_bits()
     btrfs_set_delalloc_extent()
       spin_lock(&BTRFS_I(inode)->lock); --> Line 2007 or 2017 or 2029 
(Lock B)

btrfs_inode_safe_disk_i_size_write()
   spin_lock(&BTRFS_I(inode)->lock); --> Line 53 (Lock B)
   find_contiguous_extent_bit()
     spin_lock(&tree->lock); --> Line 1620 (Lock A)

When __set_extent_bit() and btrfs_inode_safe_disk_i_size_write() are 
concurrently executed, the deadlock can occur.

# DEADLOCK 3:
convert_extent_bit()
   spin_lock(&tree->lock); --> Line 1241 (Lock A)
   set_state_bits()
     btrfs_set_delalloc_extent()
       spin_lock(&BTRFS_I(inode)->lock); --> Line 2007 or 2017 or 2029 
(Lock B)

btrfs_inode_safe_disk_i_size_write()
   spin_lock(&BTRFS_I(inode)->lock); --> Line 53 (Lock B)
   find_contiguous_extent_bit()
     spin_lock(&tree->lock); --> Line 1620 (Lock A)

When convert_extent_bit() and btrfs_inode_safe_disk_i_size_write() are 
concurrently executed, the deadlock can occur.

I am not quite sure whether these possible deadlocks are real and how to 
fix them if they are real.
Any feedback would be appreciated, thanks :)

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>


Best wishes,
Jia-Ju Bai