From 23f91a51425ed3d4a5c42978fc25f1087611e4ba Mon Sep 17 00:00:00 2001 From: Kefeng Wang Date: Mon, 21 Sep 2026 15:10:30 +0800 Subject: [PATCH] xfs: fix NOFS state corruption in btree split worker xfs_btree_split_worker() calls xfs_trans_set_context() and xfs_trans_clear_context() on the caller's transaction, overwriting tp->t_pflags with the worker's NOFS state. When the caller already has PF_MEMALLOC_NOFS set (e.g. xfs_end_ioend_write, xfs_dio_write_end_io), the corrupted tp->t_pflags causes xfs_trans_free() to erroneously clear the caller's NOFS protection. Use memalloc_nofs_save/restore with a local variable instead so tp->t_pflags is never touched. Closes: https://sashiko.dev/#/patchset/20260902131653.1338227-1-wangkefeng.wang@huawei.com Fixes: 756b1c343333 ("xfs: use current->journal_info for detecting transaction recursion") Signed-off-by: Kefeng Wang Reviewed-by: Christoph Hellwig Reviewed-by: Brian Foster Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino --- fs/xfs/libxfs/xfs_btree.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c index 60ef7f08b1d3..7effebe297ea 100644 --- a/fs/xfs/libxfs/xfs_btree.c +++ b/fs/xfs/libxfs/xfs_btree.c @@ -3010,6 +3010,7 @@ xfs_btree_split_worker( struct xfs_btree_split_args, work); unsigned long pflags; unsigned long new_pflags = 0; + unsigned int nofs_flags; /* * we are in a transaction context here, but may also be doing work @@ -3021,12 +3022,17 @@ xfs_btree_split_worker( new_pflags |= PF_MEMALLOC | PF_KSWAPD; current_set_flags_nested(&pflags, new_pflags); - xfs_trans_set_context(args->cur->bc_tp); + + /* + * Don't use xfs_trans_set_context() here: it would overwrite the + * caller's saved NOFS state in tp->t_pflags. Use a local scope. + */ + nofs_flags = memalloc_nofs_save(); args->result = __xfs_btree_split(args->cur, args->level, args->ptrp, args->key, args->curp, args->stat); - xfs_trans_clear_context(args->cur->bc_tp); + memalloc_nofs_restore(nofs_flags); current_restore_flags_nested(&pflags, new_pflags); /*