Forwarded: Re: [syzbot] [xfs?] INFO: task hung in xlog_force_lsn (2)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: Re: [syzbot] [xfs?] INFO: task hung in xlog_force_lsn (2)
Author: ytohnuki@xxxxxxxxxx

#syz test

diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index f807f8f4f705..2645052042bf 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -426,6 +426,23 @@ xlog_state_shutdown_callbacks(
        struct xlog_in_core     *iclog;
        LIST_HEAD(cb_list);
 
+       /*
+        * Shutdown waiters on ic_force_wait do not require callback completion.
+        * Once log shutdown has been established, they only need to wake,
+        * observe xlog_is_shutdown(), and abort with -EIO.
+        *
+        * Wake them before processing callbacks to avoid deadlock if callback
+        * processing blocks on a buffer lock and prevents the wakeup from being
+        * reached.
+        *
+        * Keep ic_write_wait wakeups ordered after callback processing so
+        * shutdown callback side effects still complete before teardown progresses.
+        */
+       iclog = log->l_iclog;
+       do {
+               wake_up_all(&iclog->ic_force_wait);
+       } while ((iclog = iclog->ic_next) != log->l_iclog);
+
        iclog = log->l_iclog;
        do {
                if (atomic_read(&iclog->ic_refcnt)) {
@@ -439,7 +456,6 @@ xlog_state_shutdown_callbacks(
 
                spin_lock(&log->l_icloglock);
                wake_up_all(&iclog->ic_write_wait);
-               wake_up_all(&iclog->ic_force_wait);
        } while ((iclog = iclog->ic_next) != log->l_iclog);
 
        wake_up_all(&log->l_flush_wait);
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index edc368938f30..a4244a8c43e1 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -1721,7 +1721,7 @@ xlog_cil_push_now(
        ASSERT(push_seq && push_seq <= cil->xc_current_sequence);
 
        /* start on any pending background push to minimise wait time on it */
-       if (!async)
+       if (!async && !xlog_is_shutdown(log))
                flush_workqueue(cil->xc_push_wq);
 
        spin_lock(&cil->xc_push_lock);
-- 
2.50.1



Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284

Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705