On Tue, Apr 22, 2025 at 07:51:49AM +0200, hch wrote:
> On Tue, Apr 22, 2025 at 05:03:19AM +0000, Shinichiro Kawasaki wrote:
> > I ran blktests with the kernel v6.15-rc3, and found the test case md/001 hangs.
> > The hang is recreated in stable manner. I bisected and found this patch as the
> > commit 777d0961ff95 is the trigger. When I revert the commit from v6.15-rc3
> > kernel, the hang disappeared.
> >
> > Actions for fix will be appreciated.
> >
> > FYI, the kernel INFO messages recorded functions relevant to the trigger commit,
> > such as bdev_statx or vfs_getattr_nosec [1].
>
> This should fix it:
>
> diff --git a/block/bdev.c b/block/bdev.c
> index 6a34179192c9..97d4c0ab1670 100644
> --- a/block/bdev.c
> +++ b/block/bdev.c
> @@ -1274,18 +1274,23 @@ void sync_bdevs(bool wait)
> */
> void bdev_statx(const struct path *path, struct kstat *stat, u32 request_mask)
> {
> - struct inode *backing_inode;
> struct block_device *bdev;
>
> - backing_inode = d_backing_inode(path->dentry);
> -
> /*
> - * Note that backing_inode is the inode of a block device node file,
> - * not the block device's internal inode. Therefore it is *not* valid
> - * to use I_BDEV() here; the block device has to be looked up by i_rdev
> - * instead.
> + * Note that d_backing_inode() returnsthe inode of a block device node
> + * file, not the block device's internal inode.
> + *
> + * Therefore it is *not* valid to use I_BDEV() here; the block device
> + * has to be looked up by i_rdev instead.
> + *
> + * Only do this lookup if actually needed to avoid the performance
> + * overhead of the lookup, and to avoid injecting bdev lifetime issues
> + * into devtmpfs.
> */
> - bdev = blkdev_get_no_open(backing_inode->i_rdev);
> + if (!(request_mask & (STATX_DIOALIGN | STATX_WRITE_ATOMIC)))
> + return;
This leaks the block device reference if blkdev_get_no_open() succeeds.
> +
> + bdev = blkdev_get_no_open(d_backing_inode(path->dentry)->i_rdev);
> if (!bdev)
> return;
>
