linux-kernel - [PATCH] btrfs: fail priority tickets in maybe_fail_all

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260114170701.6018-1-jiashengjiangcool@gmail.com>
Date: Wed, 14 Jan 2026 17:07:01 +0000
From: Jiasheng Jiang <jiashengjiangcool@...il.com>
To: Chris Mason <clm@...com>,
	David Sterba <dsterba@...e.com>,
	linux-btrfs@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Jiasheng Jiang <jiashengjiangcool@...il.com>
Subject: [PATCH] btrfs: fail priority tickets in maybe_fail_all_tickets

Differential analysis reveals that while btrfs_try_granting_tickets
correctly iterates over both space_info->priority_tickets and
space_info->tickets, the maybe_fail_all_tickets function only processes
space_info->tickets.

In scenarios where the filesystem is aborted (BTRFS_FS_ERROR), we rely
on maybe_fail_all_tickets() to wake up all tasks waiting on reservations
and notify them of the error. Because priority tickets are currently
ignored, tasks waiting on them (typically high-priority flush workers)
will not be woken up, leading to permanent tasks hangs.

Fix this inconsistency by updating maybe_fail_all_tickets() to iterate
over both priority_tickets and tickets lists, ensuring all waiting tasks
are properly errored out during a filesystem abort.

Signed-off-by: Jiasheng Jiang <jiashengjiangcool@...il.com>
---
 fs/btrfs/space-info.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index 6babbe333741..09c76df8dbc8 100644
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -1120,6 +1120,7 @@ static bool maybe_fail_all_tickets(struct btrfs_space_info *space_info)
 	struct reserve_ticket *ticket;
 	u64 tickets_id = space_info->tickets_id;
 	const int abort_error = BTRFS_FS_ERROR(fs_info);
+	struct list_head *head = &space_info->priority_tickets;
 
 	trace_btrfs_fail_all_tickets(fs_info, space_info);
 
@@ -1128,10 +1129,9 @@ static bool maybe_fail_all_tickets(struct btrfs_space_info *space_info)
 		__btrfs_dump_space_info(space_info);
 	}
 
-	while (!list_empty(&space_info->tickets) &&
-	       tickets_id == space_info->tickets_id) {
-		ticket = list_first_entry(&space_info->tickets,
-					  struct reserve_ticket, list);
+again:
+	while (!list_empty(head) && tickets_id == space_info->tickets_id) {
+		ticket = list_first_entry(head, struct reserve_ticket, list);
 		if (unlikely(abort_error)) {
 			remove_ticket(space_info, ticket, abort_error);
 		} else {
@@ -1153,6 +1153,12 @@ static bool maybe_fail_all_tickets(struct btrfs_space_info *space_info)
 			btrfs_try_granting_tickets(space_info);
 		}
 	}
+
+	if (head == &space_info->priority_tickets) {
+		head = &space_info->tickets;
+		goto again;
+	}
+
 	return (tickets_id != space_info->tickets_id);
 }
 
-- 
2.25.1