github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

xfs: fix NOFS state corruption in btree split worker

Browse Source 
xfs_btree_split_worker() calls xfs_trans_set_context() and
xfs_trans_clear_context() on the caller's transaction, overwriting
tp->t_pflags with the worker's NOFS state. When the caller already has
PF_MEMALLOC_NOFS set (e.g. xfs_end_ioend_write, xfs_dio_write_end_io),
the corrupted tp->t_pflags causes xfs_trans_free() to erroneously clear
the caller's NOFS protection.

Use memalloc_nofs_save/restore with a local variable instead so
tp->t_pflags is never touched.

Closes: https://sashiko.dev/#/patchset/20260902131653.1338227-1-wangkefeng.wang@huawei.com
Fixes: 756b1c3433 ("xfs: use current->journal_info for detecting transaction recursion")
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
This commit is contained in:
Kefeng Wang 2026-09-21 15:10:30 +08:00 committed by Carlos Maiolino
parent a90ee4305c
commit 23f91a5142
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/xfs/libxfs/xfs_btree.c
View File

@ -3010,6 +3010,7 @@ xfs_btree_split_worker(
struct xfs_btree_split_args, work);
unsigned long pflags;
unsigned long new_pflags = 0;
unsigned int nofs_flags;
/*
* we are in a transaction context here, but may also be doing work
@ -3021,12 +3022,17 @@ xfs_btree_split_worker(
new_pflags |= PF_MEMALLOC | PF_KSWAPD;
current_set_flags_nested(&pflags, new_pflags);
xfs_trans_set_context(args->cur->bc_tp);
/*
* Don't use xfs_trans_set_context() here: it would overwrite the
* caller's saved NOFS state in tp->t_pflags. Use a local scope.
*/
nofs_flags = memalloc_nofs_save();
args->result = __xfs_btree_split(args->cur, args->level, args->ptrp,
args->key, args->curp, args->stat);
xfs_trans_clear_context(args->cur->bc_tp);
memalloc_nofs_restore(nofs_flags);
current_restore_flags_nested(&pflags, new_pflags);
/*