ext4: fix deadlock on inode reallocation

Currently there is a race in ext4 when reallocating freed inode
resulting in a deadlock:

Task1					Task2
ext4_evict_inode()
  handle = ext4_journal_start();
  ...
  if (IS_SYNC(inode))
    handle->h_sync = 1;
  ext4_free_inode()
					ext4_new_inode()
					  handle = ext4_journal_start()
					  finds the bit in inode bitmap
					    already clear
					  insert_inode_locked()
					    waits for inode to be
					      removed from the hash.
  ext4_journal_stop(handle)
    jbd2_journal_stop(handle)
      jbd2_log_wait_commit(journal, tid);
        - deadlocks waiting for transaction handle Task2 holds

Fix the problem by removing inode from the hash already in
ext4_clear_inode() by which time all IO for the inode is done so reuse
is already fine but we are still before possibly blocking on transaction
commit.

Reported-by: "Lai, Yi" <yi1.lai@linux.intel.com>
Link: https://lore.kernel.org/all/abNvb2PcrKj1FBeC@ly-workstation
Fixes: 88ec797c4680 ("fs: make insert_inode_locked() wait for inode destruction")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260320090428.24899-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index cb69a9b38b7ca95e3272a2c377a4b82bc3c0dbde..a34efb44e73d70d034aa2ed1b4011a6851235f22 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1523,6 +1523,27 @@ void ext4_clear_inode(struct inode *inode)
        invalidate_inode_buffers(inode);
        clear_inode(inode);
        ext4_discard_preallocations(inode);
+       /*
+        * We must remove the inode from the hash before ext4_free_inode()
+        * clears the bit in inode bitmap as otherwise another process reusing
+        * the inode will block in insert_inode_hash() waiting for inode
+        * eviction to complete while holding transaction handle open, but
+        * ext4_evict_inode() still running for that inode could block waiting
+        * for transaction commit if the inode is marked as IS_SYNC => deadlock.
+        *
+        * Removing the inode from the hash here is safe. There are two cases
+        * to consider:
+        * 1) The inode still has references to it (i_nlink > 0). In that case
+        * we are keeping the inode and once we remove the inode from the hash,
+        * iget() can create the new inode structure for the same inode number
+        * and we are fine with that as all IO on behalf of the inode is
+        * finished.
+        * 2) We are deleting the inode (i_nlink == 0). In that case inode
+        * number cannot be reused until ext4_free_inode() clears the bit in
+        * the inode bitmap, at which point all IO is done and reuse is fine
+        * again.
+        */
+       remove_inode_hash(inode);
        ext4_es_remove_extent(inode, 0, EXT_MAX_BLOCKS);
        dquot_drop(inode);
        if (EXT4_I(inode)->jinode) {