Re: [PATCH] nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()

[Viacheslav Dubeyko]

On Thu, 2026-09-24 at 01:41 +0900, Ryusuke Konishi wrote:
> Syzbot reported a deadlock between nilfs_evict_inode(), executed via
> an asynchronous workqueue (kworker) as:
> 
>   process_one_work()
>     process_scheduled_works()
>       nilfs_iput_work_func()
>         nilfs_dispose_list()
>           iput()
>             iput_final()
>               evict()
>                 s_op->evict_inode()
>                   nilfs_evict_inode()
> 
> and find_inode(), called via
> 
>   nilfs_mkdir()
>     nilfs_new_inode()
>       nilfs_insert_inode_locked()
>         insert_inode_locked4()
>           inode_insert5()
>             find_inode()
> 
> When an inode is deleted (i_nlink == 0), nilfs_evict_inode() clears
> its
> ifile bitmap entry and then synchronously triggers the log writer via
> nilfs_transaction_commit() if IS_SYNC(inode) is true.
> 
> If a concurrent directory creation via nilfs_new_inode() attempts to
> allocate the same newly freed inode number, however, find_inode()
> called
> just before inserting it into the inode hash, blocks waiting for the
> old
> inode's evict() to complete.
> 
> Meanwhile, the synchronous log writer invoked from
> nilfs_evict_inode()
> tries to acquire a write lock on 'ns_segctor_sem' which is read
> locked
> by the caller of nilfs_new_inode() (in this case, nilfs_mkdir()),
> resulting in a deadlock.
> 
> The synchronous log writer invocation from nilfs_evict_inode() is a
> legacy artifact; it is no longer necessary because the call itself
> (triggered by iput()) is now handled asynchronously with a kworker
> if i_nlink == 0.  It merely increases the risk of deadlock.
> 
> Fix this deadlock by removing the synchronous log writer trigger from
> nilfs_evict_inode().
> 
> Reported-by: syzbot+6646318bbcf419411bc5@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=6646318bbcf419411bc5
> Fixes: 7ef3ff2fea8b ("nilfs2: fix deadlock of segment constructor
> over I_SYNC flag")
> Tested-by: syzbot+6646318bbcf419411bc5@xxxxxxxxxxxxxxxxxxxxxxxxx
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@xxxxxxxxx>
> ---
> Hi Viacheslav,
> 
> Please apply this bug fix.
> 
> This fixes a deadlock issue that had been reported by syzbot but
> remained unresolved for over a year.
> 
> Thanks,
> Ryusuke Konishi
> 
>  fs/nilfs2/inode.c | 6 ------
>  1 file changed, 6 deletions(-)
> 
> diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
> index 64437aed8390..33490e8063eb 100644
> --- a/fs/nilfs2/inode.c
> +++ b/fs/nilfs2/inode.c
> @@ -895,13 +895,7 @@ void nilfs_evict_inode(struct inode *inode)
>  
>  	nilfs_clear_inode(inode);
>  
> -	if (IS_SYNC(inode))
> -		nilfs_set_transaction_flag(NILFS_TI_SYNC);
>  	nilfs_transaction_commit(sb);
> -	/*
> -	 * May construct a logical segment and may fail in sync
> mode.
> -	 * But delete_inode has no return value.
> -	 */
>  }
>  
>  int nilfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,

Applied.

Thanks,
Slava.