In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: zoned: fix deadlock between metadata writeback and transaction commit<\/p>\n
When writing out metadata extent buffers in a zoned filesystem,
\nbtree_writepages() holds fs_info->zoned_meta_io_lock across the whole
\nwriteback loop, including the call to btrfs_check_meta_write_pointer() ->
\ncheck_bg_is_active().<\/p>\n
For the tree-log block group, check_bg_is_active() may fail to activate
\nthe zone and fall back to btrfs_zone_finish_one_bg() to free an active
\nzone. That path waits for the running transaction to commit while still
\nholding zoned_meta_io_lock, but the committer needs that same lock to
\nwrite out the tree extents, so the two tasks deadlock:<\/p>\n
Task A (kworker, metadata writeback) Task B (fsstress, transaction commit)
\n ———————————— ————————————-
\n wb_workfn() btrfs_commit_transaction(T)
\n btree_writepages() btrfs_write_and_wait_transaction()
\n btrfs_zoned_meta_io_lock() btrfs_write_marked_extents()
\n btrfs_check_meta_write_pointer() btree_writepages()
\n check_bg_is_active() [treelog_bg] btrfs_zoned_meta_io_lock()
\n btrfs_zone_finish_one_bg()
\n do_zone_finish()
\n btrfs_inc_block_group_ro()
\n btrfs_wait_for_commit()<\/p>\n
The sibling branch in check_bg_is_active() already drops zoned_meta_io_lock
\naround do_zone_finish() for this exact reason. Do the same in the tree-log
\nbranch: release the lock around btrfs_zone_finish_one_bg() and re-acquire
\nit afterwards. The lock only protects fs_info->active_{meta,system}_bg,
\nwhich this branch does not touch, and ctx->zoned_bg keeps a reference to
\nthe block group across the unlock, so nothing is lost while the lock
\nis dropped.<\/p>\n
This hang occasionally reproduces with fstests generic\/475 on a zoned
\nbtrfs filesystem.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: zoned: fix deadlock between metadata writeback and transaction commit<\/p>\n
When writing out metadata extent buffers in a zoned f<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7592","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7592","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7592"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7592"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7592"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}