linux-kernel - Re: [PATCH] btrfs: fail priority tickets in maybe_fail_all

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAL3q7H4rLMtmWTe4jHrYMnUbOkJb_5rMUfB8YUNhJ=JXnJp5AQ@mail.gmail.com>
Date: Wed, 14 Jan 2026 17:20:59 +0000
From: Filipe Manana <fdmanana@...nel.org>
To: Jiasheng Jiang <jiashengjiangcool@...il.com>
Cc: Chris Mason <clm@...com>, David Sterba <dsterba@...e.com>, linux-btrfs@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] btrfs: fail priority tickets in maybe_fail_all_tickets

On Wed, Jan 14, 2026 at 5:07 PM Jiasheng Jiang
<jiashengjiangcool@...il.com> wrote:
>
> Differential analysis reveals that while btrfs_try_granting_tickets

Let's pause for a second.
This is yet another patch where you mention this "differential analysis".
Please try to understand the code instead of comparing parts of the
code and assuming any differences mean a bug or that we need to do
something.

> correctly iterates over both space_info->priority_tickets and
> space_info->tickets, the maybe_fail_all_tickets function only processes
> space_info->tickets.

Yes, and there's a reason for that.

>
> In scenarios where the filesystem is aborted (BTRFS_FS_ERROR), we rely
> on maybe_fail_all_tickets() to wake up all tasks waiting on reservations
> and notify them of the error. Because priority tickets are currently
> ignored, tasks waiting on them (typically high-priority flush workers)
> will not be woken up, leading to permanent tasks hangs.

Wrong.
We never wait on a ticket's waitqueue when it's a priority ticket...
That's why maybe_fail_all_tickets() ignores the priority tickets list.

Doing this "differential analysis" without understanding all the code
and how different parts interact, and without hitting the bug or
seeing someone reporting such a hang, is just a waste of time.

>
> Fix this inconsistency by updating maybe_fail_all_tickets() to iterate
> over both priority_tickets and tickets lists, ensuring all waiting tasks
> are properly errored out during a filesystem abort.
>
> Signed-off-by: Jiasheng Jiang <jiashengjiangcool@...il.com>
> ---
>  fs/btrfs/space-info.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
> index 6babbe333741..09c76df8dbc8 100644
> --- a/fs/btrfs/space-info.c
> +++ b/fs/btrfs/space-info.c
> @@ -1120,6 +1120,7 @@ static bool maybe_fail_all_tickets(struct btrfs_space_info *space_info)
>         struct reserve_ticket *ticket;
>         u64 tickets_id = space_info->tickets_id;
>         const int abort_error = BTRFS_FS_ERROR(fs_info);
> +       struct list_head *head = &space_info->priority_tickets;
>
>         trace_btrfs_fail_all_tickets(fs_info, space_info);
>
> @@ -1128,10 +1129,9 @@ static bool maybe_fail_all_tickets(struct btrfs_space_info *space_info)
>                 __btrfs_dump_space_info(space_info);
>         }
>
> -       while (!list_empty(&space_info->tickets) &&
> -              tickets_id == space_info->tickets_id) {
> -               ticket = list_first_entry(&space_info->tickets,
> -                                         struct reserve_ticket, list);
> +again:
> +       while (!list_empty(head) && tickets_id == space_info->tickets_id) {
> +               ticket = list_first_entry(head, struct reserve_ticket, list);
>                 if (unlikely(abort_error)) {
>                         remove_ticket(space_info, ticket, abort_error);
>                 } else {
> @@ -1153,6 +1153,12 @@ static bool maybe_fail_all_tickets(struct btrfs_space_info *space_info)
>                         btrfs_try_granting_tickets(space_info);
>                 }
>         }
> +
> +       if (head == &space_info->priority_tickets) {
> +               head = &space_info->tickets;
> +               goto again;
> +       }
> +
>         return (tickets_id != space_info->tickets_id);
>  }
>
> --
> 2.25.1
>
>