6.19 tmpfs __d_lookup() lockup

[Hugh Dickins <hughd@google.com>]

Hi Al,

Though good for ordinary usage, your persistency mods for 6.19 cause
tmpfs to lockup in __d_lookup() during several fsstressing xfstests:
fairly reliably in generic/269, generic/476, generic/650, generic/750,
less reliably in generic/013, generic/585.  Typical dmesg below.
I have not spotted what's wrong: better hand over to you.

Of course, 2313598222f9 ("convert ramfs and tmpfs") (of Feb 26 2024!)
comes out as the first failing commit, no surprise there.

I did try inserting a BUG_ON(node == node->next) on line 2438 of
fs/dcache.c, just after __d_lookup's hlist_bl_for_each_entry_rcu(),
and that BUG was immediately hit (but, for all I know, perhaps that's
an unreliable asserition, perhaps it's acceptable for a race to result
in a momentary node == node->next there).

I did try hacking on xfstests common/rc, to allow ramfs where tmpfs
is enabled (and _df_device() then needs $DF_PROG -a to show ramfs).
I did not get a lockup or crash from any of them on ramfs (and 476 and
750 actually passed).  I don't draw any conclusion from that, maybe
ramfs just does not support some of the options which help fsstress
to generate the issue; but it might be useful background info.

Hoping you can soon guess what's gone wrong,
or ask for more info, thanks,
Hugh

[   54.354788] run fstests generic/269 at 2025-12-10 19:40:16
[  114.660512] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
[  114.670705] rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-7): P3185
[  114.681006] rcu: 	(detected by 6, t=15007 jiffies, g=3377, q=6940 ncpus=8)
[  114.691346] task:fsstress        state:R  running task     stack:0     pid:3185  tgid:3185  ppid:3059   task_flags:0x400140 flags:0x00080003
[  114.702226] Call Trace:
[  114.712908]  <TASK>
[  114.723528]  __schedule+0x67c/0x6c5
[  114.734245]  ? __d_lookup_rcu+0x7a/0x9c
[  114.744921]  ? irqentry_exit+0x27/0x35
[  114.755547]  ? sysvec_apic_timer_interrupt+0xa8/0xae
[  114.766300]  ? asm_sysvec_apic_timer_interrupt+0x1b/0x20
[  114.776953]  ? __d_lookup+0x37/0xad
[  114.787357]  ? __d_lookup+0x2f/0xad
[  114.797700]  ? d_lookup+0x2b/0x42
[  114.807970]  ? lookup_dcache+0x1f/0x60
[  114.818265]  ? lookup_one_qstr_excl+0x1a/0xbe
[  114.828525]  ? do_renameat2+0x1d1/0x3e4
[  114.838808]  ? getname_flags+0x4b/0x17a
[  114.849093]  ? __do_sys_rename+0x36/0x3e
[  114.859363]  ? __x64_sys_rename+0x11/0x13
[  114.869634]  ? x64_sys_call+0x34d/0xe2c
[  114.879797]  ? do_syscall_64+0x53/0x123
[  114.889820]  ? entry_SYSCALL_64_after_hwframe+0x4b/0x53
[  114.899748]  </TASK>