[PATCH v2] xfs: shut down zoned file systems on writeback errors

[PATCH v2] xfs: shut down zoned file systems on writeback errors

[Yao Sang]

Zoned writeback allocates space from an open zone and advances the
in-memory allocation state before submitting the bio. The completion
path only records the written blocks and updates the mapping on success.
If the write fails, XFS cannot tell how far the device write pointer
advanced and cannot safely roll the open zone accounting back.

This was observed while investigating xfs/643 and xfs/646 on an external
ZNS realtime device. A writeback error after consuming space from an
open zone left later writers waiting for open-zone or GC progress that
could not happen. xfs/643 exposed this through the GC defragmentation
path, while xfs/646 exposed the same failure mode through the
truncate/EOF-zeroing space wait path.

There is no local recovery path in ioend completion that can restore a
consistent zoned allocation state after the device has rejected the
write. Treat writeback errors for zoned inodes as fatal and force a
file system shutdown from the ioend completion path. The existing
shutdown path wakes zoned allocation waiters and makes future space
waits return -EIO instead of leaving tasks stuck waiting for progress.

Signed-off-by: Yao Sang <sangyao@kylinos.cn>
---
Changes in v2:
- Reflow the comment to improve readability.

Link to v1:
https://lore.kernel.org/all/20260611015305.1583003-1-sangyao@kylinos.cn 

 fs/xfs/xfs_aops.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 1a82cf625a08..2a0c54256e93 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -139,6 +139,17 @@ xfs_end_ioend_write(
 	 */
 	error = blk_status_to_errno(ioend->io_bio.bi_status);
 	if (unlikely(error)) {
+		/*
+		 * Zoned writes update the in-core open zone accounting before
+		 * I/O submission.  A failed write leaves that state
+		 * inconsistent, so shut down the filesystem instead of letting
+		 * later writers wait forever for open zone space to become
+		 * available.
+		 */
+		if (is_zoned) {
+			xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
+			goto done;
+		}
 		if (ioend->io_flags & IOMAP_IOEND_SHARED) {
 			ASSERT(!is_zoned);
 			xfs_reflink_cancel_cow_range(ip, offset, size, true);
-- 
2.25.1

Re: [PATCH v2] xfs: shut down zoned file systems on writeback errors

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH v2] xfs: shut down zoned file systems on writeback errors

[Carlos Maiolino]

On Fri, 12 Jun 2026 10:44:30 +0800, Yao Sang wrote:
> Zoned writeback allocates space from an open zone and advances the
> in-memory allocation state before submitting the bio. The completion
> path only records the written blocks and updates the mapping on success.
> If the write fails, XFS cannot tell how far the device write pointer
> advanced and cannot safely roll the open zone accounting back.
> 
> This was observed while investigating xfs/643 and xfs/646 on an external
> ZNS realtime device. A writeback error after consuming space from an
> open zone left later writers waiting for open-zone or GC progress that
> could not happen. xfs/643 exposed this through the GC defragmentation
> path, while xfs/646 exposed the same failure mode through the
> truncate/EOF-zeroing space wait path.
> 
> [...]

Applied to for-next, thanks!

[1/1] xfs: shut down zoned file systems on writeback errors
      commit: f4f28ffe09248e747ffd6b752cbad0f7a34af475

Best regards,
-- 
Carlos Maiolino <cem@kernel.org>

Re: [PATCH v2] xfs: shut down zoned file systems on writeback errors

[Christoph Hellwig]

FYI, this causes errors in generic/441 and xfs/665.  In generic/441
the file system get shut down now before the error could be propagated
to fsync, and similarly for xfs/656 the file system gets shutdown
before reporting fserror events.  In both cases the behavior makes
sense when a file system is not intended to survive data write errors.
I guess we need to introduce some way to check if a given file system
config will shut down on errors?