Bug Mechanism and Root Cause Analysis

1. Involved Files, Functions, and Data Structures

• Source Files:
  • fs/cachefiles/namei.c (defect site)
  • fs/cachefiles/cache.c
  • fs/ext4/ext4_jbd2.c (manifestation site)
  • fs/ext4/inode.c, fs/ext4/namei.c
• Functions:
  • cachefiles_add_cache() (fs/cachefiles/cache.c)
  • cachefiles_get_directory() (fs/cachefiles/namei.c)
  • vfs_mkdir() (fs/namei.c)
  • ext4_mkdir() (fs/ext4/namei.c)
  • ext4_dirty_inode() (fs/ext4/inode.c)
  • ext4_journal_check_start() (fs/ext4/ext4_jbd2.c)
• Structures & Fields:
  • struct cachefiles_cache (cache->mnt)
  • struct super_block (sb->s_flags, specifically SB_RDONLY checked via sb_rdonly(sb))

2. Root Cause & Detailed Execution Flow

1. Missing Write References (mnt_want_write) in cachefiles_get_directory(): When adding and initializing a cache backend in cachefiles_add_cache(), cachefiles looks up the root cache directory and initially performs a read-only check:

   ret = -EROFS;
   if (sb_rdonly(root->d_sb))
       goto error_unsupported;
   

   After this check, cachefiles_add_cache() proceeds to create or look up its required subdirectories ("cache" and "graveyard") by calling cachefiles_get_directory().

   When the subdirectories do not exist, cachefiles_get_directory() calls start_creating(&nop_mnt_idmap, dir, ...) and then invokes vfs_mkdir():

   subdir = vfs_mkdir(&nop_mnt_idmap, d_inode(dir), subdir, 0700, NULL);
   

   Unlike standard VFS path-creation helpers (such as filename_create() / start_creating_path(), or nfsd4_create_clid_dir()), cachefiles_get_directory() does not call mnt_want_write(cache->mnt) before invoking modifying operations on the underlying filesystem, nor does it drop it afterwards with mnt_drop_write(cache->mnt).

2. Race with Read-Only Remount (MS_REMOUNT | MS_RDONLY): The VFS write count (mnt->mnt_writers / sb->s_writers) is the mechanism that blocks read-only remounts (sb_prepare_remount_readonly()) while filesystem modification operations are active. Because cachefiles_get_directory() does not hold a write reference on cache->mnt:

   • A concurrent mount operation with MS_REMOUNT | MS_RDONLY is allowed to proceed without waiting for the directory creation to finish.
   • The remount operation sets sb->s_flags |= SB_RDONLY and flushes/reconfigures the journal.

3. Manifestation in ext4_journal_check_start(): Concurrently, vfs_mkdir() invokes the underlying filesystem's directory creation callback (ext4_mkdir()). During directory allocation (ext4_init_new_dir() -> ext4_append() -> ext4_mb_new_blocks() -> dquot_alloc_block() -> mark_inode_dirty()), ext4_dirty_inode() attempts to start a journal handle:

   handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
   

   Which invokes ext4_journal_check_start(sb):

   if (WARN_ON_ONCE(sb_rdonly(sb)))
       return -EROFS;
   

   Because sb->s_flags has been updated with SB_RDONLY by the concurrent remount, sb_rdonly(sb) evaluates to true, triggering the WARN_ON_ONCE warning.

3. Suggested Fix

In fs/cachefiles/namei.c, cachefiles_get_directory() must bracket calls to vfs_mkdir() (and other modifying operations such as vfs_unlink or vfs_rename) with mnt_want_write(cache->mnt) and mnt_drop_write(cache->mnt), or check the error code and abort directory creation if the mount is or becomes read-only.