ceph: avoid pending truncate during nonblocking cap acquire

[PATCH] ceph: avoid pending truncate during nonblocking cap acquire

Posted by Max Kellermann 3 weeks ago

Readahead acquires caps while the folios are locked.  This can
deadlock when processing a pending truncate; truncate_pagecache() can
then attempt to a folio that is already locked.

Return -EAGAIN instead when `NON_BLOCKING` is set, causing the
readahead to be abandoned.

Fixes: 49870056005c ("ceph: convert ceph_readpages to ceph_readahead")
Cc: stable@vger.kernel.org
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
---
 fs/ceph/caps.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index bcb04c6cb92c..86e195c5fd32 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2889,6 +2889,10 @@ static int try_get_cap_refs(struct inode *inode, int need, int want,
 	}
 
 	/* finish pending truncate */
+	if (ci->i_truncate_pending && (flags & NON_BLOCKING)) {
+		ret = -EAGAIN;
+		goto out_unlock;
+	}
 	while (ci->i_truncate_pending) {
 		spin_unlock(&ci->i_ceph_lock);
 		if (snap_rwsem_locked) {
-- 
2.47.3

Re: [PATCH] ceph: avoid pending truncate during nonblocking cap acquire

Posted by Xiubo Li 3 weeks ago

LGTM.

Reviewed-by: Xiubo Li <xiubo.li@clyso.com>

On Fri, 4 Sept 2026 at 03:33, Max Kellermann <max.kellermann@ionos.com> wrote:
>
> Readahead acquires caps while the folios are locked.  This can
> deadlock when processing a pending truncate; truncate_pagecache() can
> then attempt to a folio that is already locked.
>
> Return -EAGAIN instead when `NON_BLOCKING` is set, causing the
> readahead to be abandoned.
>
> Fixes: 49870056005c ("ceph: convert ceph_readpages to ceph_readahead")
> Cc: stable@vger.kernel.org
> Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
> ---
>  fs/ceph/caps.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
> index bcb04c6cb92c..86e195c5fd32 100644
> --- a/fs/ceph/caps.c
> +++ b/fs/ceph/caps.c
> @@ -2889,6 +2889,10 @@ static int try_get_cap_refs(struct inode *inode, int need, int want,
>         }
>
>         /* finish pending truncate */
> +       if (ci->i_truncate_pending && (flags & NON_BLOCKING)) {
> +               ret = -EAGAIN;
> +               goto out_unlock;
> +       }
>         while (ci->i_truncate_pending) {
>                 spin_unlock(&ci->i_ceph_lock);
>                 if (snap_rwsem_locked) {
> --
> 2.47.3
>