[PATCH v2 4/5] powerpc/spufs: fix deadlock on gang creation failure
From: Junrui Luo via B4 Relay <devnull+moonafterrain.outlook.com@kernel.org>
Date: 2026-08-04 08:50:54
Also in:
b4-sent, lkml, stable
Subsystem:
cell broadband engine architecture, linux for powerpc (32-bit and 64-bit), spu file system, the rest · Maintainers:
Madhavan Srinivasan, Linus Torvalds
From: Junrui Luo <redacted>
do_spu_create() enters spufs with the parent directory's i_rwsem held
for write, taken as I_MUTEX_PARENT by start_creating_user_path() and
dropped only by end_creating_path(). When spufs_gang_open() fails inside
that window, spufs_create_gang() cleans up by calling unuse_gang().
The gang was just created, so gang->alive drops to 0 and unuse_gang()
proceeds to simple_recursive_removal(), which takes the parent inode's
i_rwsem as I_MUTEX_CHILD. This leads to the task blocking on an rwsem it
already holds, leaving the spufs directory write-locked. The other two
callers of unuse_gang() do not hold the parent lock: spufs_gang_close()
runs from ->release, and spufs_dir_close() drops the parent lock first.
Tell unuse_gang() which context it is called from, and use
locked_recursive_removal() when the parent is already held. This matches
spufs_rmdir(), which spufs_create_context() already uses for the same
cleanup under the same lock.
Fixes: c134deabf478 ("spufs: fix gang directory lifetimes")
Reported-by: Yuhao Jiang <redacted>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <redacted>
---
arch/powerpc/platforms/cell/spufs/inode.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
index c2b15c30f7c0..998512409552 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c@@ -175,7 +175,8 @@ static int spufs_fill_dir(struct dentry *dir, return 0; } -static void unuse_gang(struct dentry *dir) +/* @parent_locked: caller holds dir->d_parent's i_rwsem as I_MUTEX_PARENT */ +static void unuse_gang(struct dentry *dir, bool parent_locked) { struct inode *inode = dir->d_inode; struct spu_gang *gang = SPUFS_I(inode)->i_gang;
@@ -187,8 +188,12 @@ static void unuse_gang(struct dentry *dir) dead = !--gang->alive; inode_unlock(inode); - if (dead) - simple_recursive_removal(dir, NULL); + if (dead) { + if (parent_locked) + locked_recursive_removal(dir, NULL); + else + simple_recursive_removal(dir, NULL); + } } }
@@ -204,7 +209,7 @@ static int spufs_dir_close(struct inode *inode, struct file *file) spufs_rmdir(parent, dir); inode_unlock(parent); - unuse_gang(dir->d_parent); + unuse_gang(dir->d_parent, false); return dcache_dir_close(inode, file); }
@@ -483,7 +488,7 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode) static int spufs_gang_close(struct inode *inode, struct file *file) { - unuse_gang(file->f_path.dentry); + unuse_gang(file->f_path.dentry, false); return dcache_dir_close(inode, file); }
@@ -520,7 +525,7 @@ static int spufs_create_gang(struct inode *inode, if (!ret) { ret = spufs_gang_open(&path); if (ret < 0) - unuse_gang(dentry); + unuse_gang(dentry, true); } return ret; }
--
2.51.2