3 files changed, 46 insertions, 11 deletions

diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 68ca41dbbef3..f7f955109d8b 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3163,6 +3163,9 @@ void btrfs_destroy_inode(struct inode *inode);
 int btrfs_drop_inode(struct inode *inode);
 int __init btrfs_init_cachep(void);
 void __cold btrfs_destroy_cachep(void);
+struct inode *btrfs_iget_path(struct super_block *s, struct btrfs_key *location,
+                              struct btrfs_root *root, int *new,
+                              struct btrfs_path *path);
 struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
                          struct btrfs_root *root, int *was_new);
 struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 4ba0aedc878b..74aa552f4793 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -75,7 +75,8 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root,
          * sure NOFS is set to keep us from deadlocking.
          */
         nofs_flag = memalloc_nofs_save();
-        inode = btrfs_iget(fs_info->sb, &location, root, NULL);
+        inode = btrfs_iget_path(fs_info->sb, &location, root, NULL, path);
+        btrfs_release_path(path);
         memalloc_nofs_restore(nofs_flag);
         if (IS_ERR(inode))
                 return inode;
@@ -838,6 +839,25 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info,
         path->search_commit_root = 1;
         path->skip_locking = 1;
 
+        /*
+         * We must pass a path with search_commit_root set to btrfs_iget in
+         * order to avoid a deadlock when allocating extents for the tree root.
+         *
+         * When we are COWing an extent buffer from the tree root, when looking
+         * for a free extent, at extent-tree.c:find_free_extent(), we can find
+         * block group without its free space cache loaded. When we find one
+         * we must load its space cache which requires reading its free space
+         * cache's inode item from the root tree. If this inode item is located
+         * in the same leaf that we started COWing before, then we end up in
+         * deadlock on the extent buffer (trying to read lock it when we
+         * previously write locked it).
+         *
+         * It's safe to read the inode item using the commit root because
+         * block groups, once loaded, stay in memory forever (until they are
+         * removed) as well as their space caches once loaded. New block groups
+         * once created get their ->cached field set to BTRFS_CACHE_FINISHED so
+         * we will never try to read their inode item while the fs is mounted.
+         */
         inode = lookup_free_space_inode(fs_info, block_group, path);
         if (IS_ERR(inode)) {
                 btrfs_free_path(path);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 55761b1519f5..e71daadd2f75 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3569,10 +3569,11 @@ static noinline int acls_after_inode_item(struct extent_buffer *leaf,
 /*
  * read an inode from the btree into the in-memory inode
  */
-static int btrfs_read_locked_inode(struct inode *inode)
+static int btrfs_read_locked_inode(struct inode *inode,
+                                   struct btrfs_path *in_path)
 {
         struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
-        struct btrfs_path *path;
+        struct btrfs_path *path = in_path;
         struct extent_buffer *leaf;
         struct btrfs_inode_item *inode_item;
         struct btrfs_root *root = BTRFS_I(inode)->root;
@@ -3588,15 +3589,18 @@ static int btrfs_read_locked_inode(struct inode *inode)
         if (!ret)
                 filled = true;
 
-        path = btrfs_alloc_path();
-        if (!path)
-                return -ENOMEM;
+        if (!path) {
+                path = btrfs_alloc_path();
+                if (!path)
+                        return -ENOMEM;
+        }
 
         memcpy(&location, &BTRFS_I(inode)->location, sizeof(location));
 
         ret = btrfs_lookup_inode(NULL, root, path, &location, 0);
         if (ret) {
-                btrfs_free_path(path);
+                if (path != in_path)
+                        btrfs_free_path(path);
                 return ret;
         }
 
@@ -3721,7 +3725,8 @@ cache_acl:
                                   btrfs_ino(BTRFS_I(inode)),
                                   root->root_key.objectid, ret);
         }
-        btrfs_free_path(path);
+        if (path != in_path)
+                btrfs_free_path(path);
 
         if (!maybe_acls)
                 cache_no_acl(inode);
@@ -5643,8 +5648,9 @@ static struct inode *btrfs_iget_locked(struct super_block *s,
 /* Get an inode object given its location and corresponding root.
  * Returns in *is_new if the inode was read from disk
  */
-struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
-                         struct btrfs_root *root, int *new)
+struct inode *btrfs_iget_path(struct super_block *s, struct btrfs_key *location,
+                              struct btrfs_root *root, int *new,
+                              struct btrfs_path *path)
 {
         struct inode *inode;
 
@@ -5655,7 +5661,7 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
         if (inode->i_state & I_NEW) {
                 int ret;
 
-                ret = btrfs_read_locked_inode(inode);
+                ret = btrfs_read_locked_inode(inode, path);
                 if (!ret) {
                         inode_tree_add(inode);
                         unlock_new_inode(inode);
@@ -5677,6 +5683,12 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
         return inode;
 }
 
+struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
+                         struct btrfs_root *root, int *new)
+{
+        return btrfs_iget_path(s, location, root, new, NULL);
+}
+
 static struct inode *new_simple_dir(struct super_block *s,
                                     struct btrfs_key *key,
                                     struct btrfs_root *root)