• Brian Foster's avatar
    xfs: use ->b_state to fix buffer I/O accounting release race · 0364c225
    Brian Foster authored
    commit 63db7c81 upstream.
    
    We've had user reports of unmount hangs in xfs_wait_buftarg() that
    analysis shows is due to btp->bt_io_count == -1. bt_io_count
    represents the count of in-flight asynchronous buffers and thus
    should always be >= 0. xfs_wait_buftarg() waits for this value to
    stabilize to zero in order to ensure that all untracked (with
    respect to the lru) buffers have completed I/O processing before
    unmount proceeds to tear down in-core data structures.
    
    The value of -1 implies an I/O accounting decrement race. Indeed,
    the fact that xfs_buf_ioacct_dec() is called from xfs_buf_rele()
    (where the buffer lock is no longer held) means that bp->b_flags can
    be updated from an unsafe context. While a user-level reproducer is
    currently not available, some intrusive hacks to run racing buffer
    lookups/ioacct/releases from multiple threads was used to
    successfully manufacture this problem.
    
    Existing callers do not expect to acquire the buffer lock from
    xfs_buf_rele(). Therefore, we can not safely update ->b_flags from
    this context. It turns out that we already have separate buffer
    state bits and associated serialization for dealing with buffer LRU
    state in the form of ->b_state and ->b_lock. Therefore, replace the
    _XBF_IN_FLIGHT flag with a ->b_state variant, update the I/O
    accounting wrappers appropriately and make sure they are used with
    the correct locking. This ensures that buffer in-flight state can be
    modified at buffer release time without racing with modifications
    from a buffer lock holder.
    
    Fixes: 9c7504aa ("xfs: track and serialize in-flight async buffers against unmount")
    Signed-off-by: default avatarBrian Foster <bfoster@redhat.com>
    Reviewed-by: default avatarNikolay Borisov <nborisov@suse.com>
    Tested-by: default avatarLibor Pechacek <lpechacek@suse.com>
    Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    0364c225
xfs_buf.h 12.8 KB