Re: [PATCH 5/9] ntfs: Remove FGP_NOFS from __ntfs_inode_resident_attr_pwrite()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Deadlock due to missing NOFS protection when allocating page cache memory under mrec_lock
--

commit cf448ed1a05ff7894f41c5a1a1f1f6cc405004f7
Author: Matthew Wilcox (Oracle) <willy@infradead.org>

ntfs: Remove FGP_NOFS from __ntfs_inode_resident_attr_pwrite()

This commit removes the FGP_NOFS flag from the folio allocation in
__ntfs_inode_resident_attr_pwrite(). The commit message notes that if the
protection is needed, it should be done using memalloc_nofs_save() at a
higher level.

> diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
> index 32edb4045178a..36a0d6b26c02e 100644
> --- a/fs/ntfs/inode.c
> +++ b/fs/ntfs/inode.c
> @@ -3676,7 +3676,7 @@ static s64 __ntfs_inode_resident_attr_pwrite(struct inode *vi,
>  	mark_mft_record_dirty(ctx->ntfs_ino);
>  
>  	/* Keep the first page clean and uptodate */
> -	folio = __filemap_get_folio(mapping, 0, FGP_WRITEBEGIN | FGP_NOFS,
> +	folio = __filemap_get_folio(mapping, 0, FGP_WRITEBEGIN,

[Severity: High]
Does removing FGP_NOFS here without adding the higher-level
memalloc_nofs_save() protection introduce a deadlock with flusher threads?

If a user writes a resident extended attribute via ntfs_setxattr(), the
call path acquires mrec_lock before reaching this allocation:

fs/ntfs/ea.c:ntfs_setxattr() {
    ...
    mutex_lock(&ni->mrec_lock);
    err = ntfs_set_ea(inode, name, strlen(name), value, size, flags, NULL);
    mutex_unlock(&ni->mrec_lock);
    ...
}

Without FGP_NOFS, the folio allocation can now occur with __GFP_FS enabled.
If the system is under memory pressure and blocks to wait for flusher
threads, those threads may attempt to write back pages for this NTFS
filesystem. The writeback path also unconditionally acquires the same
mrec_lock:

fs/ntfs/iomap.c:ntfs_write_iomap_begin_non_resident() {
    ...
    mutex_lock(&NTFS_I(inode)->mrec_lock);
    ...
}

Can this cause a cyclic deadlock on mrec_lock if the flusher thread blocks
waiting on the locked inode?

>  				   mapping_gfp_mask(mapping));
>  	if (IS_ERR(folio)) {
>  		err = PTR_ERR(folio);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260830041901.2668-1-willy@infradead.org?part=5