Root Cause Analysis

1. Context and Involved Entities

• Source Files:
  • fs/btrfs/inode.c: Inode eviction handling (btrfs_evict_inode()).
  • fs/btrfs/disk-io.c: Filesystem teardown and root destruction (close_ctree(), btrfs_put_root(), btrfs_free_fs_info()).
  • fs/btrfs/delayed-inode.c: Delayed node tracking, commit, and release (btrfs_commit_inode_delayed_inode(), btrfs_remove_delayed_node(), __btrfs_release_delayed_node()).
• Key Structs and Fields:
  • struct btrfs_root::delayed_nodes: XArray tracking delayed nodes associated with inodes in that root.
  • struct btrfs_inode::delayed_node: Pointer caching the associated struct btrfs_delayed_node.
  • struct btrfs_delayed_node::refs: Reference count of the delayed node (one held by btrfs_inode::delayed_node, one held by btrfs_delayed_root::node_list when count > 0, plus any transient caller references).
  • struct btrfs_delayed_node::count: Count of pending delayed items/updates.
  • struct btrfs_fs_info::delayed_root: Global delayed root tracking lists (node_list, prepare_list).

2. Triggering Sequence and Lifecycle Invariant Violation

1. Transaction Abort State (state EA): During filesystem operation or unmount, an error occurred and the current transaction was aborted (BTRFS_FS_STATE_TRANS_ABORTED set, reflected in the state EA log message before unmount).

2. Unmount Sequence in close_ctree(): During unmount (generic_shutdown_super() $\to$ btrfs_put_super() $\to$ close_ctree()):

   • At line 4394 of fs/btrfs/disk-io.c, close_ctree() checks BTRFS_FS_ERROR(fs_info) and invokes btrfs_error_commit_super(fs_info). This calls btrfs_cleanup_transaction(fs_info), which invokes btrfs_destroy_delayed_inodes(fs_info) to destroy any delayed items currently in fs_info->delayed_root.node_list and verifies the list with btrfs_assert_delayed_root_empty(fs_info).
   • Subsequently, at lines 4455 and 4478 of fs/btrfs/disk-io.c, close_ctree() calls btrfs_run_delayed_iputs(fs_info). This processes pending delayed iputs generated by preceding operations and ordered extents, calling iput(&inode->vfs_inode).

3. Error Handling Defect in btrfs_evict_inode(): When iput() drops the last reference to an inode, VFS calls btrfs_evict_inode():

   ret = btrfs_commit_inode_delayed_inode(BTRFS_I(inode));
   if (ret)
           goto out;
   
   btrfs_kill_delayed_inode_items(BTRFS_I(inode));
   ...
   out:
   btrfs_remove_delayed_node(BTRFS_I(inode));
   clear_inode:
   clear_inode(inode);
   

   • In btrfs_commit_inode_delayed_inode(), btrfs_join_transaction() fails with -EROFS because the transaction has been aborted.
   • Because ret < 0, btrfs_evict_inode() immediately executes goto out;, bypassing btrfs_kill_delayed_inode_items(). The delayed node retains BTRFS_DELAYED_NODE_INODE_DIRTY and its item count (delayed_node->count > 0).

4. Reference Imbalance and Omission from XArray Erase: At label out:, btrfs_evict_inode() invokes btrfs_remove_delayed_node():

   void btrfs_remove_delayed_node(struct btrfs_inode *inode)
   {
           struct btrfs_delayed_node *delayed_node;
   
           delayed_node = READ_ONCE(inode->delayed_node);
           if (!delayed_node)
                   return;
   
           inode->delayed_node = NULL;
           btrfs_release_delayed_node(delayed_node, &delayed_node->inode_cache_tracker);
   }
   

   In __btrfs_release_delayed_node():

   mutex_lock(&delayed_node->mutex);
   if (delayed_node->count)
           btrfs_queue_delayed_node(delayed_root, delayed_node, mod);
   else
           btrfs_dequeue_delayed_node(delayed_root, delayed_node);
   mutex_unlock(&delayed_node->mutex);
   
   btrfs_delayed_node_ref_tracker_free(delayed_node, tracker);
   if (refcount_dec_and_test(&delayed_node->refs)) {
           struct btrfs_root *root = delayed_node->root;
   
           xa_erase(&root->delayed_nodes, delayed_node->inode_id);
           ...
           kmem_cache_free(delayed_node_cache, delayed_node);
   }
   

   • Because delayed_node->count remains $> 0$, btrfs_queue_delayed_node() queues the node into delayed_root->node_list (and increments node->refs if not already queued).
   • When refcount_dec_and_test(&delayed_node->refs) decrements the reference held by inode->delayed_node, delayed_node->refs does not reach zero because delayed_root->node_list still holds a reference.
   • As a result, xa_erase(&root->delayed_nodes, delayed_node->inode_id) is skipped, leaving the delayed node stored in root->delayed_nodes.
   • The inode itself is cleared and deallocated, removing it from root->inodes.
   • Because btrfs_destroy_delayed_inodes() in close_ctree() ran prior to btrfs_run_delayed_iputs(), no further cleanup pass iterates or kills delayed nodes.

5. Failure Manifestation: After close_ctree() finishes, btrfs_kill_super() calls btrfs_free_fs_info(), which calls btrfs_put_root(fs_info->fs_root). When dropping the last reference to the root:

   if (WARN_ON(!xa_empty(&root->inodes)))
           xa_destroy(&root->inodes);
   if (WARN_ON(!xa_empty(&root->delayed_nodes)))
           xa_destroy(&root->delayed_nodes);
   

   xa_empty(&root->inodes) is true (all inodes were destroyed), but xa_empty(&root->delayed_nodes) is false, triggering the reported warning at fs/btrfs/disk-io.c:1844.