From: Chris Mason Writes to a loop device with direct I/O on an overlay file make the next freeze of the upper filesystem hang for ever. Every kiocb_start_write() needs a kiocb_end_write(). For a write that is queued, vfs_iocb_iter_write() leaves the end to the completion, and backing_aio_rw_complete() only calls kiocb_end_write() when IOCB_WRITE is set in the flags copied from the submitter. In-kernel submitters such as loop do not set that flag, so each queued write keeps the freeze protection of the backing filesystem. Direct writes to a loop device with direct I/O backed by an overlay file left fsfreeze of the ext4 upper filesystem, and a later touch there, blocked in D state. It takes write access to the node of the loop device, which root has by default, to attach the file and to write. The fix used here is to mark a write in struct backing_aio and to call kiocb_end_write() on completion of every marked write. Reproduced under qemu without KVM, on v7.3-rc6-21-g602042bf29f6 with earlier fixes of this series applied, with and without this change, once each. The kernel was not changed for the run. With this change fsfreeze finished in about a second. Not run: the nvmet and LIO file backends, which do not set IOCB_WRITE either, FUSE passthrough, and an xfs upper filesystem. Fixes: 2406a307ac7d ("ovl: implement async IO routines") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [amir: use aio->is_write to explicitly mark a write aio] Signed-off-by: Amir Goldstein --- Christian, This fixes a nasty little bug. It is not critical because it cannot be exploited by unpriv, but innocent priv users could hit it by mistake. I could carry it via ovl-fixes with your ACK or you could take it with your other backing file fixes. Which way do you prefer? Thanks, Amir. fs/backing-file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/backing-file.c b/fs/backing-file.c index cc101143f9212..ca8654fa1d83b 100644 --- a/fs/backing-file.c +++ b/fs/backing-file.c @@ -84,6 +84,7 @@ struct backing_aio { refcount_t ref; struct kiocb *orig_iocb; /* used for aio completion */ + bool is_write; void (*end_write)(struct kiocb *iocb, ssize_t); struct work_struct work; long res; @@ -124,7 +125,8 @@ static void backing_aio_rw_complete(struct kiocb *iocb, long res) struct backing_aio *aio = container_of(iocb, struct backing_aio, iocb); struct kiocb *orig_iocb = aio->orig_iocb; - if (iocb->ki_flags & IOCB_WRITE) + /* Pairs with kiocb_start_write() in vfs_iocb_iter_write() */ + if (aio->is_write) kiocb_end_write(iocb); backing_aio_cleanup(aio, res); @@ -239,6 +241,7 @@ static int do_backing_file_write_iter(struct file *file, struct iov_iter *iter, return -ENOMEM; aio->orig_iocb = iocb; + aio->is_write = true; aio->end_write = end_write; kiocb_clone(&aio->iocb, iocb, get_file(file)); aio->iocb.ki_flags = flags; -- 2.55.0