Btrfs: fix race leading to fs corruption after transaction abort [Linux 4.14.137]

This Linux kernel change "Btrfs: fix race leading to fs corruption after transaction abort" is included in the Linux 4.14.137 release. This change is authored by Filipe Manana <fdmanana [at]> on Thu Jul 25 11:27:04 2019 +0100. The commit for this change in Linux stable tree is 66a25e3 (patch) which is from upstream commit cb2d3da. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream cb2d3da.

Btrfs: fix race leading to fs corruption after transaction abort

commit cb2d3daddbfb6318d170e79aac1f7d5e4d49f0d7 upstream.

When one transaction is finishing its commit, it is possible for another
transaction to start and enter its initial commit phase as well. If the
first ends up getting aborted, we have a small time window where the second
transaction commit does not notice that the previous transaction aborted
and ends up committing, writing a superblock that points to btrees that
reference extent buffers (nodes and leafs) that were not persisted to disk.
The consequence is that after mounting the filesystem again, we will be
unable to load some btree nodes/leafs, either because the content on disk
is either garbage (or just zeroes) or corresponds to the old content of a
previouly COWed or deleted node/leaf, resulting in the well known error
messages "parent transid verify failed on ...".
The following sequence diagram illustrates how this can happen.

        CPU 1                                           CPU 2

 <at transaction N>

   --> sets transaction state to
   --> sets fs_info->running_transaction
       to NULL

                                                          --> returns immediately
                                                              is NULL
                                                          --> creates transaction N + 1
                                                          --> sets
                                                              to transaction N + 1
                                                          --> adds transaction N + 1 to
                                                              the fs_info->trans_list list
                                                        --> returns transaction handle
                                                            pointing to the new
                                                            transaction N + 1

                                                        --> returns handle to
                                                            transaction N + 1

     --> writeback of some extent
         buffer fails, returns an
     --> sets BTRFS_FS_STATE_ERROR in
   --> jumps to label "scrub_continue"
           flag in fs_info->fs_state
       --> sets aborted field in the
           transaction and transaction
       handle structures, for
           transaction N only
     --> removes transaction from the
         list fs_info->trans_list
                                                      btrfs_commit_transaction(N + 1)
                                                        --> transaction N + 1 was not
                                aborted, so it proceeds
                                                        --> sets the transaction's state
                                                            to TRANS_STATE_COMMIT_START
                                                        --> does not find the previous
                                                            transaction (N) in the
                                                            fs_info->trans_list, so it
                                                            doesn't know that transaction
                                                            was aborted, and the commit
                                                            of transaction N + 1 proceeds
                                                        --> sets transaction N + 1 state
                                                            to TRANS_STATE_UNBLOCKED
                                                          --> succeeds writing all extent
                                                              buffers created in the
                                                              transaction N + 1
                                                           --> succeeds
                                                           --> we now have a superblock on
                                                               disk that points to trees
                                                               that refer to at least one
                                                               extent buffer that was
                                                               never persisted

So fix this by updating the transaction commit path to check if the flag
BTRFS_FS_STATE_TRANS_ABORTED is set on fs_info->fs_state if after setting
the transaction to the TRANS_STATE_COMMIT_START we do not find any previous
transaction in the fs_info->trans_list. If the flag is set, just fail the
transaction commit with -EROFS, as we do in other places. The exact error
code for the previous transaction abort was already logged and reported.

Fixes: 49b25e0540904b ("btrfs: enhance transaction abort infrastructure")
CC: # 4.4+
Reviewed-by: Josef Bacik <>
Signed-off-by: Filipe Manana <>
Reviewed-by: David Sterba <>
Signed-off-by: David Sterba <>
Signed-off-by: Greg Kroah-Hartman <>

There are 10 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 fs/btrfs/transaction.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 73c1fbc..fa8f56e 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -2052,6 +2052,16 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
    } else {
+       /*
+        * The previous transaction was aborted and was already removed
+        * from the list of transactions at fs_info->trans_list. So we
+        * abort to prevent writing a new superblock that reflects a
+        * corrupt state (pointing to trees with unwritten nodes/leafs).
+        */
+       if (test_bit(BTRFS_FS_STATE_TRANS_ABORTED, &fs_info->fs_state)) {
+           ret = -EROFS;
+           goto cleanup_transaction;
+       }

    extwriter_counter_dec(cur_trans, trans->type);

Leave a Reply

Your email address will not be published. Required fields are marked *