linux/fs/btrfs
Robbie Ko 9ac63333d6 btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
commit 5037b34282 upstream.

When wait_current_trans() is called during start_transaction(), it
currently waits for a blocked transaction without considering whether
the given transaction type actually needs to wait for that particular
transaction state. The btrfs_blocked_trans_types[] array already defines
which transaction types should wait for which transaction states, but
this check was missing in wait_current_trans().

This can lead to a deadlock scenario involving two transactions and
pending ordered extents:

  1. Transaction A is in TRANS_STATE_COMMIT_DOING state

  2. A worker processing an ordered extent calls start_transaction()
     with TRANS_JOIN

  3. join_transaction() returns -EBUSY because Transaction A is in
     TRANS_STATE_COMMIT_DOING

  4. Transaction A moves to TRANS_STATE_UNBLOCKED and completes

  5. A new Transaction B is created (TRANS_STATE_RUNNING)

  6. The ordered extent from step 2 is added to Transaction B's
     pending ordered extents

  7. Transaction B immediately starts commit by another task and
     enters TRANS_STATE_COMMIT_START

  8. The worker finally reaches wait_current_trans(), sees Transaction B
     in TRANS_STATE_COMMIT_START (a blocked state), and waits
     unconditionally

  9. However, TRANS_JOIN should NOT wait for TRANS_STATE_COMMIT_START
     according to btrfs_blocked_trans_types[]

  10. Transaction B is waiting for pending ordered extents to complete

  11. Deadlock: Transaction B waits for ordered extent, ordered extent
      waits for Transaction B

This can be illustrated by the following call stacks:
  CPU0                              CPU1
                                    btrfs_finish_ordered_io()
                                      start_transaction(TRANS_JOIN)
                                        join_transaction()
                                          # -EBUSY (Transaction A is
                                          # TRANS_STATE_COMMIT_DOING)
  # Transaction A completes
  # Transaction B created
  # ordered extent added to
  # Transaction B's pending list
  btrfs_commit_transaction()
    # Transaction B enters
    # TRANS_STATE_COMMIT_START
    # waiting for pending ordered
    # extents
                                        wait_current_trans()
                                          # waits for Transaction B
                                          # (should not wait!)

Task bstore_kv_sync in btrfs_commit_transaction waiting for ordered
extents:

  __schedule+0x2e7/0x8a0
  schedule+0x64/0xe0
  btrfs_commit_transaction+0xbf7/0xda0 [btrfs]
  btrfs_sync_file+0x342/0x4d0 [btrfs]
  __x64_sys_fdatasync+0x4b/0x80
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Task kworker in wait_current_trans waiting for transaction commit:

  Workqueue: btrfs-syno_nocow btrfs_work_helper [btrfs]
  __schedule+0x2e7/0x8a0
  schedule+0x64/0xe0
  wait_current_trans+0xb0/0x110 [btrfs]
  start_transaction+0x346/0x5b0 [btrfs]
  btrfs_finish_ordered_io.isra.0+0x49b/0x9c0 [btrfs]
  btrfs_work_helper+0xe8/0x350 [btrfs]
  process_one_work+0x1d3/0x3c0
  worker_thread+0x4d/0x3e0
  kthread+0x12d/0x150
  ret_from_fork+0x1f/0x30

Fix this by passing the transaction type to wait_current_trans() and
checking btrfs_blocked_trans_types[cur_trans->state] against the given
type before deciding to wait. This ensures that transaction types which
are allowed to join during certain blocked states will not unnecessarily
wait and cause deadlocks.

Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Robbie Ko <robbieko@synology.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Cc: Motiejus Jakštys <motiejus@jakstys.lt>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-23 11:21:36 +01:00
..
tests btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
accessors.c btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
accessors.h btrfs: accessors: delete token versions of set/get helpers 2025-07-22 00:05:00 +02:00
acl.c btrfs: remove unused included headers 2024-03-04 16:24:46 +01:00
acl.h btrfs: update include and forward declarations in headers 2025-03-18 20:35:43 +01:00
async-thread.c btrfs: use list_first_entry() everywhere 2025-05-15 14:30:47 +02:00
async-thread.h btrfs: add forward declarations and headers, part 1 2024-03-04 16:24:49 +01:00
backref.c btrfs: add unlikely annotations to branches leading to EIO 2025-09-23 08:49:26 +02:00
backref.h btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
bio.c btrfs: add unlikely annotations to branches leading to EIO 2025-09-23 08:49:26 +02:00
bio.h btrfs: try to search for data csums in commit root 2025-09-22 10:54:31 +02:00
block-group.c btrfs: fix racy bitfield write in btrfs_clear_space_info_full() 2025-12-18 14:03:16 +01:00
block-group.h btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
block-rsv.c btrfs: add block reserve for treelog 2025-05-15 14:30:53 +02:00
block-rsv.h btrfs: add block reserve for treelog 2025-05-15 14:30:53 +02:00
btrfs_inode.h for-6.18-tag 2025-09-30 08:14:49 -07:00
compression.c btrfs: prepare compression folio alloc/free for bs > ps cases 2025-09-23 08:49:24 +02:00
compression.h btrfs: prepare compression folio alloc/free for bs > ps cases 2025-09-23 08:49:24 +02:00
ctree.c btrfs: fix leaf leak in an error path in btrfs_del_items() 2025-12-18 14:03:16 +01:00
ctree.h btrfs: split btrfs_is_fstree() into multiple if statements for readability 2025-07-21 23:58:04 +02:00
defrag.c btrfs: add unlikely annotations to branches leading to EIO 2025-09-23 08:49:26 +02:00
defrag.h btrfs: pass struct btrfs_inode to btrfs_defrag_file() 2025-03-18 20:35:43 +01:00
delalloc-space.c btrfs: add block reserve for treelog 2025-05-15 14:30:53 +02:00
delalloc-space.h btrfs: pass struct btrfs_inode to btrfs_free_reserved_data_space_noquota() 2025-05-15 14:30:52 +02:00
delayed-inode.c btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() 2026-01-17 16:35:18 +01:00
delayed-inode.h btrfs: fix delayed_node ref_tracker use after free 2025-10-22 09:40:04 +02:00
delayed-ref.c btrfs: fix double free of qgroup record after failure to add delayed ref head 2025-12-18 14:03:16 +01:00
delayed-ref.h btrfs: move ref-verify under CONFIG_BTRFS_DEBUG 2025-09-22 10:54:32 +02:00
dev-replace.c btrfs: add unlikely annotations to branches leading to EIO 2025-09-23 08:49:26 +02:00
dev-replace.h btrfs: trivial conversion to return bool instead of int 2025-05-15 14:30:49 +02:00
dir-item.c btrfs: rename inode number parameter passed to btrfs_check_dir_item_collision() 2025-07-22 00:05:00 +02:00
dir-item.h btrfs: rename inode number parameter passed to btrfs_check_dir_item_collision() 2025-07-22 00:05:00 +02:00
direct-io.c btrfs: enable experimental bs > ps support 2025-09-23 08:49:25 +02:00
direct-io.h btrfs: update include and forward declarations in headers 2025-03-18 20:35:43 +01:00
discard.c btrfs: use verbose assert at peek_discard_list() 2025-05-15 14:30:55 +02:00
discard.h btrfs: update include and forward declarations in headers 2025-03-18 20:35:43 +01:00
disk-io.c for-6.18-tag 2025-10-06 13:53:19 -07:00
disk-io.h btrfs: convert several int parameters to bool 2025-09-22 10:54:32 +02:00
export.c btrfs: avoid potential out-of-bounds in btrfs_encode_fh() 2025-09-26 08:48:30 +02:00
export.h btrfs: add forward declarations and headers, part 1 2024-03-04 16:24:49 +01:00
extent-io-tree.c btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
extent-io-tree.h btrfs: convert several int parameters to bool 2025-09-22 10:54:32 +02:00
extent-tree.c btrfs: add unlikely annotations to branches leading to transaction abort 2025-09-23 08:49:26 +02:00
extent-tree.h btrfs: convert several int parameters to bool 2025-09-22 10:54:32 +02:00
extent_io.c btrfs: fix beyond-EOF write handling 2026-01-17 16:35:31 +01:00
extent_io.h btrfs: prepare compression folio alloc/free for bs > ps cases 2025-09-23 08:49:24 +02:00
extent_map.c for-6.18-tag 2025-09-30 08:14:49 -07:00
extent_map.h btrfs: rename remaining exported extent map functions 2025-05-15 14:30:45 +02:00
fiemap.c btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
fiemap.h btrfs: move fiemap code into its own file 2024-07-11 15:33:20 +02:00
file-item.c btrfs: add unlikely annotations to branches leading to transaction abort 2025-09-23 08:49:26 +02:00
file-item.h btrfs: change return type of btrfs_alloc_dummy_sum() to int 2025-05-15 14:30:49 +02:00
file.c btrfs: fix changeset leak on mmap write after failure to reserve metadata 2026-01-02 12:56:37 +01:00
file.h btrfs: update include and forward declarations in headers 2025-03-18 20:35:43 +01:00
free-space-cache.c btrfs: add unlikely annotations to branches leading to transaction abort 2025-09-23 08:49:26 +02:00
free-space-cache.h btrfs: add cancellation points to trim loops 2024-10-07 23:21:56 +02:00
free-space-tree.c btrfs: do not assert we found block group item when creating free space tree 2025-10-13 22:33:22 +02:00
free-space-tree.h btrfs: add btrfs prefix to free space tree exported functions 2025-07-21 23:58:02 +02:00
fs.c btrfs: enable experimental bs > ps support 2025-09-23 08:49:25 +02:00
fs.h btrfs: prepare compression folio alloc/free for bs > ps cases 2025-09-23 08:49:24 +02:00
inode-item.c btrfs: add unlikely annotations to branches leading to transaction abort 2025-09-23 08:49:26 +02:00
inode-item.h btrfs: remove unused parameters from btrfs_lookup_inode_extref() 2025-07-21 23:58:03 +02:00
inode.c btrfs: release path before iget_failed() in btrfs_read_locked_inode() 2026-01-23 11:21:15 +01:00
ioctl.c btrfs: don't rewrite ret from inode_permission 2026-01-02 12:57:08 +01:00
ioctl.h tree-wide: s/struct fileattr/struct file_kattr/g 2025-07-04 16:14:39 +02:00
Kconfig btrfs: implement ref_tracker for delayed_nodes 2025-09-22 10:54:32 +02:00
locking.c btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
locking.h btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
lru_cache.c btrfs: fix typos found by codespell 2023-12-15 23:00:04 +01:00
lru_cache.h btrfs: cleanup recursive include of the same header 2024-07-11 15:33:22 +02:00
lzo.c btrfs: add unlikely annotations to branches leading to EUCLEAN 2025-09-23 08:49:26 +02:00
Makefile btrfs: move ref-verify under CONFIG_BTRFS_DEBUG 2025-09-22 10:54:32 +02:00
messages.c btrfs: dump detailed info and specific messages on log replay failures 2025-09-23 08:49:21 +02:00
messages.h btrfs: remove duplicate inclusion of linux/types.h 2025-09-22 10:54:31 +02:00
misc.h btrfs: introduce btrfs_bio_for_each_block_all() helper 2025-09-23 08:49:17 +02:00
ordered-data.c btrfs: truncate ordered extent when skipping writeback past i_size 2026-01-17 16:35:30 +01:00
ordered-data.h btrfs: introduce a read path dedicated extent lock helper 2025-03-18 20:35:48 +01:00
orphan.c btrfs: BTRFS_PATH_AUTO_FREE in orphan.c 2024-09-10 16:51:22 +02:00
orphan.h btrfs: add forward declarations and headers, part 1 2024-03-04 16:24:49 +01:00
print-tree.c btrfs: print-tree: print key types as human readable strings 2025-09-23 08:49:23 +02:00
print-tree.h btrfs: update include and forward declarations in headers 2025-03-18 20:35:43 +01:00
props.c btrfs: props: switch prop_handler::extract to struct btrfs_inode 2025-03-18 20:35:44 +01:00
props.h btrfs: pass struct btrfs_inode to btrfs_inode_inherit_props() 2025-03-18 20:35:44 +01:00
qgroup.c btrfs: qgroup: update all parent qgroups when doing quick inherit 2026-01-17 16:35:18 +01:00
qgroup.h btrfs: update include and forward declarations in headers 2025-03-18 20:35:43 +01:00
raid-stripe-tree.c btrfs: add unlikely annotations to branches leading to transaction abort 2025-09-23 08:49:26 +02:00
raid-stripe-tree.h btrfs: update include and forward declarations in headers 2025-03-18 20:35:43 +01:00
raid56.c btrfs: add unlikely annotations to branches leading to EIO 2025-09-23 08:49:26 +02:00
raid56.h btrfs: prepare scrub to support bs > ps cases 2025-09-23 08:49:25 +02:00
ref-verify.c btrfs: ref-verify: fix IS_ERR() vs NULL check in btrfs_build_ref_tree() 2025-10-22 09:40:07 +02:00
ref-verify.h btrfs: move ref-verify under CONFIG_BTRFS_DEBUG 2025-09-22 10:54:32 +02:00
reflink.c btrfs: add unlikely annotations to branches leading to transaction abort 2025-09-23 08:49:26 +02:00
reflink.h btrfs: add forward declarations and headers, part 1 2024-03-04 16:24:49 +01:00
relocation.c btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running 2025-10-13 22:29:03 +02:00
relocation.h btrfs: don't print relocation messages from auto reclaim 2025-07-22 00:09:22 +02:00
root-tree.c btrfs: add unlikely annotations to branches leading to transaction abort 2025-09-23 08:49:26 +02:00
root-tree.h btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations 2024-04-02 19:18:23 +02:00
scrub.c btrfs: scrub: always update btrfs_scrub_progress::last_physical 2026-01-02 12:56:41 +01:00
scrub.h btrfs: convert several int parameters to bool 2025-09-22 10:54:32 +02:00
send.c btrfs: send: check for inline extents in range_is_hole_in_parent() 2026-01-23 11:21:15 +01:00
send.h btrfs: pass btrfs_root pointers to send ioctl parameters 2025-03-18 20:35:49 +01:00
space-info.c btrfs: fix memory leaks in create_space_info() error paths 2026-01-23 11:21:17 +01:00
space-info.h btrfs: fix racy bitfield write in btrfs_clear_space_info_full() 2025-12-18 14:03:16 +01:00
subpage.c btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
subpage.h btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
super.c btrfs: only enforce free space tree if v1 cache is required for bs < ps cases 2026-01-17 16:35:25 +01:00
super.h btrfs: change BTRFS_MOUNT_* flags to 64bit type 2024-07-19 17:20:23 +02:00
sysfs.c btrfs: simplify support block size check 2025-09-22 10:54:31 +02:00
sysfs.h btrfs: update include and forward declarations in headers 2025-03-18 20:35:43 +01:00
transaction.c btrfs: fix deadlock in wait_current_trans() due to ignored transaction type 2026-01-23 11:21:36 +01:00
transaction.h btrfs: move abort_should_print_stack() to transaction.h 2025-01-13 14:53:17 +01:00
tree-checker.c btrfs: tree-checker: fix bounds check in check_inode_extref() 2025-10-13 22:35:51 +02:00
tree-checker.h btrfs: validate system chunk array at btrfs_validate_super() 2025-01-13 14:53:18 +01:00
tree-log.c btrfs: fix NULL pointer dereference in do_abort_log_replay() 2026-01-17 16:35:25 +01:00
tree-log.h btrfs: avoid transaction commit on any fsync after subvolume creation 2024-07-11 15:33:24 +02:00
tree-mod-log.c btrfs: reduce size of struct tree_mod_elem 2025-07-22 00:09:20 +02:00
tree-mod-log.h btrfs: drop unused parameter path from btrfs_tree_mod_log_rewind() 2024-11-11 14:34:15 +01:00
ulist.c btrfs: use rb_find_add() in ulist_rbtree_insert() 2025-07-21 23:53:25 +02:00
ulist.h btrfs: preallocate ulist memory for qgroup rsv 2024-07-11 15:33:26 +02:00
uuid-tree.c btrfs: uuid-tree: remove unnecessary call to btrfs_mark_buffer_dirty() 2025-01-13 14:53:20 +01:00
uuid-tree.h btrfs: move uuid tree related code to uuid-tree.[ch] 2024-09-10 16:51:12 +02:00
verity.c for-6.18-tag 2025-09-30 08:14:49 -07:00
verity.h btrfs: add forward declarations and headers, part 1 2024-03-04 16:24:49 +01:00
volumes.c btrfs: fix memory leak of fs_devices in degraded seed device path 2026-01-02 12:56:37 +01:00
volumes.h btrfs: fix typos in comments and strings 2025-09-23 08:49:16 +02:00
xattr.c btrfs: replace strcpy() with strscpy() 2025-07-22 00:05:00 +02:00
xattr.h btrfs: update include and forward declarations in headers 2025-03-18 20:35:43 +01:00
zlib.c btrfs: add unlikely annotations to branches leading to EIO 2025-09-23 08:49:26 +02:00
zoned.c for-6.18-rc5-tag 2025-11-11 10:13:17 -08:00
zoned.h btrfs: zoned: return error from btrfs_zone_finish_endio() 2025-09-22 10:54:30 +02:00
zstd.c btrfs: add unlikely annotations to branches leading to EIO 2025-09-23 08:49:26 +02:00