[PATCH] netfs: fix ENOMEM handling in netfs_writepages() to drain all dirty folios

[PATCH] netfs: fix ENOMEM handling in netfs_writepages() to drain all dirty folios

[Yun Zhou]

When netfs_create_write_req() fails with -ENOMEM in netfs_writepages(),
the couldnt_start error path redirties and unlocks the first folio, then
calls writeback_iter() expecting it to return NULL. However, if the
mapping contains multiple dirty folios, writeback_iter() returns the
next one, triggering WARN_ON_ONCE(folio != NULL).

This can be reproduced via 9p (cache=loose) with shared mmap writes and
fault injection (fail_nth), where v9fs_mmap_vm_close() triggers
writeback on a mapping with multiple dirty folios during mmap overlap.

Fix this by looping over all remaining dirty folios in the ENOMEM path,
redirtying and unlocking each one. This ensures all folios taken by the
writeback iterator are properly released, and they will be retried on
the next writeback cycle when memory is available.

Reported-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0da43efa72f88bd3a8af
Fixes: ac5f95ac5d6d ("netfs: Fix writeback error handling")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
---
 fs/netfs/write_issue.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
index f2761c99795a..5aa47128f7e7 100644
--- a/fs/netfs/write_issue.c
+++ b/fs/netfs/write_issue.c
@@ -597,10 +597,11 @@ int netfs_writepages(struct address_space *mapping,
 
 couldnt_start:
 	if (error == -ENOMEM) {
-		folio_redirty_for_writepage(wbc, folio);
-		folio_unlock(folio);
-		folio = writeback_iter(mapping, wbc, folio, &error);
-		WARN_ON_ONCE(folio != NULL);
+		/* Redirty all dirty folios and let writeback retry later. */
+		do {
+			folio_redirty_for_writepage(wbc, folio);
+			folio_unlock(folio);
+		} while ((folio = writeback_iter(mapping, wbc, folio, &error)));
 	} else {
 		netfs_kill_dirty_pages(mapping, wbc, folio);
 	}
-- 
2.43.0

Re: [PATCH] netfs: fix ENOMEM handling in netfs_writepages() to drain all dirty folios

[Zhou, Yun]

Tested-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com

https://lore.kernel.org/all/6a4c9787.a1ad617e.25832.0006.GAE@google.com/

On 7/7/26 13:25, Yun Zhou wrote:
> When netfs_create_write_req() fails with -ENOMEM in netfs_writepages(),
> the couldnt_start error path redirties and unlocks the first folio, then
> calls writeback_iter() expecting it to return NULL. However, if the
> mapping contains multiple dirty folios, writeback_iter() returns the
> next one, triggering WARN_ON_ONCE(folio != NULL).
> 
> This can be reproduced via 9p (cache=loose) with shared mmap writes and
> fault injection (fail_nth), where v9fs_mmap_vm_close() triggers
> writeback on a mapping with multiple dirty folios during mmap overlap.
> 
> Fix this by looping over all remaining dirty folios in the ENOMEM path,
> redirtying and unlocking each one. This ensures all folios taken by the
> writeback iterator are properly released, and they will be retried on
> the next writeback cycle when memory is available.
> 
> Reported-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=0da43efa72f88bd3a8af
> Fixes: ac5f95ac5d6d ("netfs: Fix writeback error handling")
> Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
> ---
>   fs/netfs/write_issue.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
> index f2761c99795a..5aa47128f7e7 100644
> --- a/fs/netfs/write_issue.c
> +++ b/fs/netfs/write_issue.c
> @@ -597,10 +597,11 @@ int netfs_writepages(struct address_space *mapping,
>   
>   couldnt_start:
>   	if (error == -ENOMEM) {
> -		folio_redirty_for_writepage(wbc, folio);
> -		folio_unlock(folio);
> -		folio = writeback_iter(mapping, wbc, folio, &error);
> -		WARN_ON_ONCE(folio != NULL);
> +		/* Redirty all dirty folios and let writeback retry later. */
> +		do {
> +			folio_redirty_for_writepage(wbc, folio);
> +			folio_unlock(folio);
> +		} while ((folio = writeback_iter(mapping, wbc, folio, &error)));
>   	} else {
>   		netfs_kill_dirty_pages(mapping, wbc, folio);
>   	}