btrfs: fix pending delayed iputs when using autodefrag

Syzbot reported the following warning recently:

   [157.672][ T6611] BTRFS info (device loop0): turning on flush-on-commit
   [157.672][ T6611] BTRFS info (device loop0): enabling free space tree
   [157.672][ T6611] BTRFS info (device loop0): enabling auto defrag
   [157.672][ T6611] BTRFS info (device loop0): use lzo compression, level 1
   [157.672][ T6611] BTRFS info (device loop0): max_inline set to 4096
   [158.094][ T5608] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
   [160.073][ T6656] BTRFS info (device loop0 state M): max_inline set to 4096
   [160.418][ T5611] BTRFS info (device loop0): last unmount of filesystem ab8108e1-bea5-4a9f-94c9-a3ff208d732a
   [160.432][ T6662] loop2: detected capacity change from 0 to 32768
   [160.438][ T6662] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.74 (6662)
   [160.459][ T6662] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
   [160.459][ T6662] BTRFS info (device loop2): using crc32c checksum algorithm
   [160.634][ T1187] ------------[ cut here ]------------
   [160.634][ T1187] test_bit(BTRFS_FS_STATE_NO_DELAYED_IPUT, &fs_info->fs_state)
   [160.634][ T1187] WARNING: fs/btrfs/inode.c:3596 at btrfs_add_delayed_iput+0x2e3/0x340, CPU#0: kworker/u8:10/1187
   [160.634][ T1187] Modules linked in:
   [160.634][ T1187] CPU: 0 UID: 0 PID: 1187 Comm: kworker/u8:10 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
   [160.634][ T1187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
   [160.634][ T1187] Workqueue: btrfs-endio-write btrfs_work_helper
   [160.634][ T1187] RIP: 0010:btrfs_add_delayed_iput+0x2e3/0x340
   [160.634][ T1187] Code: 53 a3 45 (...)
   [160.634][ T1187] RSP: 0018:ffffc900065d77c8 EFLAGS: 00010293
   [160.634][ T1187] RAX: ffffffff83e5f502 RBX: ffff88805aba0000 RCX: ffff888029768000
   [160.634][ T1187] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
   [160.634][ T1187] RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
   [160.634][ T1187] R10: dffffc0000000000 R11: ffffed100b574497 R12: 0000000000000001
   [160.634][ T1187] R13: dffffc0000000000 R14: ffff888061194788 R15: 0000000000000200
   [160.634][ T1187] FS:  0000000000000000(0000) GS:ffff888126186000(0000) knlGS:0000000000000000
   [160.634][ T1187] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
   [160.634][ T1187] CR2: 00007fe553a3f000 CR3: 00000000596c2000 CR4: 00000000003526f0
   [160.634][ T1187] Call Trace:
   [160.634][ T1187]  <TASK>
   [160.634][ T1187]  btrfs_put_ordered_extent+0x18f/0x430
   [160.634][ T1187]  btrfs_finish_one_ordered+0xf63/0x2680
   [160.634][ T1187]  ? __pfx_btrfs_finish_one_ordered+0x10/0x10
   [160.634][ T1187]  ? do_raw_spin_lock+0x12b/0x2f0
   [160.634][ T1187]  ? lock_acquire+0x106/0x350
   [160.634][ T1187]  ? __pfx_do_raw_spin_lock+0x10/0x10
   [160.634][ T1187]  btrfs_work_helper+0x38b/0xc20
   [160.634][ T1187]  ? process_scheduled_works+0xa70/0x1860
   [160.634][ T1187]  process_scheduled_works+0xb5d/0x1860
   [160.634][ T1187]  ? __pfx_process_scheduled_works+0x10/0x10
   [160.634][ T1187]  ? assign_work+0x3d5/0x5e0
   [160.634][ T1187]  worker_thread+0xa53/0xfc0
   [160.634][ T1187]  kthread+0x388/0x470
   [160.634][ T1187]  ? __pfx_worker_thread+0x10/0x10
   [160.635][ T1187]  ? __pfx_kthread+0x10/0x10
   [160.635][ T1187]  ret_from_fork+0x514/0xb70
   [160.635][ T1187]  ? __pfx_ret_from_fork+0x10/0x10
   [160.635][ T1187]  ? __switch_to+0xc79/0x1410
   [160.635][ T1187]  ? __pfx_kthread+0x10/0x10
   [160.635][ T1187]  ret_from_fork_asm+0x1a/0x30
   [160.635][ T1187]  </TASK>
   [160.635][ T1187] Kernel panic - not syncing: kernel: panic_on_warn set ...

It means we add a delayed iput created after we last ran delayed iputs in
close_ctree() and set the flag BTRFS_FS_STATE_NO_DELAYED_IPUT in fs_info.

This happens when using autodefrag and more likely to happen if we use
flushoncommit too. The steps are the following:

1) Unmount starts, all delalloc is flushed and we enter close_ctree();

2) In close_ctree() we park the cleaner kthread, but while we wait for it
   to park, it's in:

     btrfs_run_defrag_inodes()
        btrfs_run_defrag_inode()
           btrfs_defrag_file()
              defrag_one_cluster()
                 defrag_one_range()
                    defrag_one_locked_target()

   And dirties some folios from an inode;

3) The cleaner kthread parks and we proceed in close_ctree(), waiting
   for all ordered extents, running delayed iputs and setting the flag
   BTRFS_FS_STATE_NO_DELAYED_IPUT in fs_info;

4) Later in close_ctree() we call btrfs_commit_super(), which commits the
   current transaction. Because we are mounted with flushoncommit, the
   transaction commit flushes delalloc and waits for the resulting ordered
   extent to complete;

5) The ordered extents from the flushed delalloc created by autodefrag
   complete and create delayed iputs, triggering the warning:

     WARN_ON_ONCE(test_bit(BTRFS_FS_STATE_NO_DELAYED_IPUT, &fs_info->fs_state));

   in btrfs_add_delayed_iput()

6) Further below in close_ctree() we will hit the following assertion:

     ASSERT(list_empty(&fs_info->delayed_iputs));

   Since we don't expect any more delayed iputs.

Fix this by flushing delalloc and waiting for the ordered extents right
after we parked the cleaner kthread and waiting for autodefrag in
close_ctree().

Reported-by: syzbot+6a843bf8604711c8fab0@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/6a1ee507.b4221f80.1326c5.0004.GAE@google.com/
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

0 files changed, 0 insertions, 0 deletions