Btrfs: fix deadlock with nested trans handles

commit 3bbb24b20a8800158c33eca8564f432dd14d0bf3 upstream.

Zach found this deadlock that would happen like this

btrfs_end_transaction <- reduce trans->use_count to 0
  btrfs_run_delayed_refs
    btrfs_cow_block
      find_free_extent
	btrfs_start_transaction <- increase trans->use_count to 1
          allocate chunk
	btrfs_end_transaction <- decrease trans->use_count to 0
	  btrfs_run_delayed_refs
	    lock tree block we are cowing above ^^

We need to only decrease trans->use_count if it is above 1, otherwise leave it
alone.  This will make nested trans be the only ones who decrease their added
ref, and will let us get rid of the trans->use_count++ hack if we have to commit
the transaction.  Thanks,

Reported-by: Zach Brown <zab@redhat.com>
Signed-off-by: Josef Bacik <jbacik@fb.com>
Tested-by: Zach Brown <zab@redhat.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 34cd831..b05bf58 100644 (file)
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -683,7 +683,8 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
        int lock = (trans->type != TRANS_JOIN_NOLOCK);
        int err = 0;
 
-       if (--trans->use_count) {
+       if (trans->use_count > 1) {
+               trans->use_count--;
                trans->block_rsv = trans->orig_rsv;
                return 0;
        }
@@ -731,17 +732,10 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
        }
 
        if (lock && ACCESS_ONCE(cur_trans->state) == TRANS_STATE_BLOCKED) {
-               if (throttle) {
-                       /*
-                        * We may race with somebody else here so end up having
-                        * to call end_transaction on ourselves again, so inc
-                        * our use_count.
-                        */
-                       trans->use_count++;
+               if (throttle)
                        return btrfs_commit_transaction(trans, root);
-               } else {
+               else
                        wake_up_process(info->transaction_kthread);
-               }
        }
 
        if (trans->type & __TRANS_FREEZABLE)