From: Filipe Manana <fdmanana@suse.com>
Date: Tue, 26 Feb 2019 12:06:09 +0000
Patch-mainline: 5.1-rc1
Git-commit: 4ea748e1d2c9f8a27332b949e8210dbbf392987e
Subject: [PATCH] Btrfs: fix deadlock between clone/dedupe and rename
References: bsc#1130518

Reflinking (clone/dedupe) and rename are operations that operate on two
inodes and therefore need to lock them in the same order to avoid ABBA
deadlocks. It happens that Btrfs' reflink implementation always locked
them in a different order from VFS's lock_two_nondirectories() helper,
which is used by the rename code in VFS, resulting in ABBA type deadlocks.

Btrfs' locking order:

  static void btrfs_double_inode_lock(struct inode *inode1, struct inode *inode2)
  {
         if (inode1 < inode2)
                swap(inode1, inode2);

         inode_lock_nested(inode1, I_MUTEX_PARENT);
         inode_lock_nested(inode2, I_MUTEX_CHILD);
  }

VFS's locking order:

  void lock_two_nondirectories(struct inode *inode1, struct inode *inode2)
  {
        if (inode1 > inode2)
                swap(inode1, inode2);

        if (inode1 && !S_ISDIR(inode1->i_mode))
                inode_lock(inode1);
        if (inode2 && !S_ISDIR(inode2->i_mode) && inode2 != inode1)
                inode_lock_nested(inode2, I_MUTEX_NONDIR2);
}

Fix this by killing the btrfs helper function that does the double inode
locking and replace it with VFS's helper lock_two_nondirectories().

Reported-by: Zygo Blaxell <ce3g8jdj@umail.furryterror.org>
Fixes: 416161db9b63e3 ("btrfs: offline dedupe")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
---
 fs/btrfs/ioctl.c | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 77951eb57f50..f12cf0d6ca6d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2958,21 +2958,6 @@ static int lock_extent_range(struct inode *inode, u64 off, u64 len,
 	return 0;
 }
 
-static void btrfs_double_inode_unlock(struct inode *inode1, struct inode *inode2)
-{
-	inode_unlock(inode1);
-	inode_unlock(inode2);
-}
-
-static void btrfs_double_inode_lock(struct inode *inode1, struct inode *inode2)
-{
-	if (inode1 < inode2)
-		swap(inode1, inode2);
-
-	inode_lock_nested(inode1, I_MUTEX_PARENT);
-	inode_lock_nested(inode2, I_MUTEX_CHILD);
-}
-
 static void btrfs_double_extent_unlock(struct inode *inode1, u64 loff1,
 				      struct inode *inode2, u64 loff2, u64 len)
 {
@@ -3249,7 +3234,7 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
 	if (same_inode)
 		inode_lock(src);
 	else
-		btrfs_double_inode_lock(src, dst);
+		lock_two_nondirectories(src, dst);
 
 	/* don't make the dst file partly checksummed */
 	if ((BTRFS_I(src)->flags & BTRFS_INODE_NODATASUM) !=
@@ -3307,7 +3292,7 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
 	if (same_inode)
 		inode_unlock(src);
 	else
-		btrfs_double_inode_unlock(src, dst);
+		unlock_two_nondirectories(src, dst);
 
 	return ret;
 }
@@ -3945,7 +3930,7 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src,
 		return -EISDIR;
 
 	if (!same_inode) {
-		btrfs_double_inode_lock(src, inode);
+		lock_two_nondirectories(src, inode);
 	} else {
 		inode_lock(src);
 	}
@@ -4038,7 +4023,7 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src,
 				round_up(destoff + len, PAGE_SIZE) - 1);
 out_unlock:
 	if (!same_inode)
-		btrfs_double_inode_unlock(src, inode);
+		unlock_two_nondirectories(src, inode);
 	else
 		inode_unlock(src);
 	return ret;
-- 
2.19.0