[PATCH v2] netfs: fix writeback ENOMEM by using __GFP_NOFAIL for rolling buffer

[PATCH v2] netfs: fix writeback ENOMEM by using __GFP_NOFAIL for rolling buffer

[Yun Zhou]

rolling_buffer_init() uses plain GFP_NOFS for its folio_queue allocation.
In the writeback path this can fail and trigger WARN_ON_ONCE(folio != NULL)
in netfs_writepages() when writeback_iter() returns additional dirty folios
left unhandled.

Writeback must not fail with -ENOMEM. Fix this by adding a gfp_t parameter
to rolling_buffer_init() and passing GFP_NOFS | __GFP_NOFAIL from the
writeback path, ensuring the allocation always succeeds. Read paths
continue to use plain GFP_NOFS.

Reported-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0da43efa72f88bd3a8af
Fixes: ac5f95ac5d6d ("netfs: Fix writeback error handling")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
---
Changes in v2:
  - Dropped the writeback_iter drain loop approach (v1) per review feedback
    from Christoph Hellwig and David Howells.
  - Instead, fix the root cause: use __GFP_NOFAIL for rolling_buffer_init()
    in the writeback path so that -ENOMEM cannot occur.
  - Added gfp_t parameter to rolling_buffer_init() to allow writeback and
    read paths to use different allocation flags.
---
 fs/netfs/buffered_read.c       | 4 ++--
 fs/netfs/rolling_buffer.c      | 4 ++--
 fs/netfs/write_issue.c         | 7 ++++++-
 include/linux/rolling_buffer.h | 2 +-
 4 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c
index 24a8a5418e31..fe84e1dd707c 100644
--- a/fs/netfs/buffered_read.c
+++ b/fs/netfs/buffered_read.c
@@ -359,7 +359,7 @@ void netfs_readahead(struct readahead_control *ractl)
 	netfs_rreq_expand(rreq, ractl);
 
 	rreq->submitted = rreq->start;
-	if (rolling_buffer_init(&rreq->buffer, rreq->debug_id, ITER_DEST) < 0)
+	if (rolling_buffer_init(&rreq->buffer, rreq->debug_id, ITER_DEST, GFP_NOFS) < 0)
 		goto cleanup_free;
 	netfs_read_to_pagecache(rreq, ractl);
 
@@ -378,7 +378,7 @@ static int netfs_create_singular_buffer(struct netfs_io_request *rreq, struct fo
 {
 	ssize_t added;
 
-	if (rolling_buffer_init(&rreq->buffer, rreq->debug_id, ITER_DEST) < 0)
+	if (rolling_buffer_init(&rreq->buffer, rreq->debug_id, ITER_DEST, GFP_NOFS) < 0)
 		return -ENOMEM;
 
 	added = rolling_buffer_append(&rreq->buffer, folio, rollbuf_flags);
diff --git a/fs/netfs/rolling_buffer.c b/fs/netfs/rolling_buffer.c
index a17fbf9853a4..3c4b1e244c46 100644
--- a/fs/netfs/rolling_buffer.c
+++ b/fs/netfs/rolling_buffer.c
@@ -60,11 +60,11 @@ EXPORT_SYMBOL(netfs_folioq_free);
  * consumer.
  */
 int rolling_buffer_init(struct rolling_buffer *roll, unsigned int rreq_id,
-			unsigned int direction)
+			unsigned int direction, gfp_t gfp)
 {
 	struct folio_queue *fq;
 
-	fq = netfs_folioq_alloc(rreq_id, GFP_NOFS, netfs_trace_folioq_rollbuf_init);
+	fq = netfs_folioq_alloc(rreq_id, gfp, netfs_trace_folioq_rollbuf_init);
 	if (!fq)
 		return -ENOMEM;
 
diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
index f2761c99795a..28bcd10ef330 100644
--- a/fs/netfs/write_issue.c
+++ b/fs/netfs/write_issue.c
@@ -98,6 +98,7 @@ struct netfs_io_request *netfs_create_write_req(struct address_space *mapping,
 			     origin == NETFS_WRITEBACK_SINGLE ||
 			     origin == NETFS_WRITETHROUGH ||
 			     origin == NETFS_PGPRIV2_COPY_TO_CACHE);
+	gfp_t gfp = GFP_NOFS;
 
 	wreq = netfs_alloc_request(mapping, file, start, 0, origin);
 	if (IS_ERR(wreq))
@@ -108,7 +109,11 @@ struct netfs_io_request *netfs_create_write_req(struct address_space *mapping,
 	ictx = netfs_inode(wreq->inode);
 	if (is_cacheable)
 		fscache_begin_write_operation(&wreq->cache_resources, netfs_i_cookie(ictx));
-	if (rolling_buffer_init(&wreq->buffer, wreq->debug_id, ITER_SOURCE) < 0)
+
+	/* Writeback is part of memory reclaim and must not fail due to ENOMEM. */
+	if (origin == NETFS_WRITEBACK || origin == NETFS_WRITEBACK_SINGLE)
+		gfp |= __GFP_NOFAIL;
+	if (rolling_buffer_init(&wreq->buffer, wreq->debug_id, ITER_SOURCE, gfp) < 0)
 		goto nomem;
 
 	wreq->cleaned_to = wreq->start;
diff --git a/include/linux/rolling_buffer.h b/include/linux/rolling_buffer.h
index ac15b1ffdd83..39b7248838e2 100644
--- a/include/linux/rolling_buffer.h
+++ b/include/linux/rolling_buffer.h
@@ -43,7 +43,7 @@ struct rolling_buffer_snapshot {
 #define ROLLBUF_MARK_2	BIT(1)
 
 int rolling_buffer_init(struct rolling_buffer *roll, unsigned int rreq_id,
-			unsigned int direction);
+			unsigned int direction, gfp_t gfp);
 int rolling_buffer_make_space(struct rolling_buffer *roll);
 ssize_t rolling_buffer_load_from_ra(struct rolling_buffer *roll,
 				    struct readahead_control *ractl,
-- 
2.43.0

Re: [PATCH v2] netfs: fix writeback ENOMEM by using __GFP_NOFAIL for rolling buffer

[David Howells]

Yun Zhou <yun.zhou@windriver.com> wrote:

> rolling_buffer_init() uses plain GFP_NOFS for its folio_queue allocation.
> In the writeback path this can fail and trigger WARN_ON_ONCE(folio != NULL)
> in netfs_writepages() when writeback_iter() returns additional dirty folios
> left unhandled.
> 
> Writeback must not fail with -ENOMEM. Fix this by adding a gfp_t parameter
> to rolling_buffer_init() and passing GFP_NOFS | __GFP_NOFAIL from the
> writeback path, ensuring the allocation always succeeds. Read paths
> continue to use plain GFP_NOFS.

I don't think this is the correct solution.  I think you're right that a gfp_t
needs to be passed into rolling_buffer*(), but I think we need a mempool as
well.

I have most of the patch for that, but I think I need adjust things so that
the read path uses GFP_KERNEL, not GFP_NOFS.

David
---
commit 3cc9160c12645c38c860e748845cb63b15115078
Author: David Howells <dhowells@redhat.com>
Date:   Fri Jul 24 10:24:30 2026 +0100

    netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
    
    Fix the handling of folio_queue allocation failure in writeback by adding a
    mempool.  The failure caused:
    
        folio != NULL
        WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919
    
    Fixes: cd0277ed0c18 ("netfs: Use new folio_queue data type and iterator instead of xarray iter")
    Reported-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=0da43efa72f88bd3a8af
    Signed-off-by: David Howells <dhowells@redhat.com>
    Tested-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com
    cc: Paulo Alcantara <pc@manguebit.org>
    cc: Yun Zhou <yun.zhou@windriver.com>
    cc: Matthew Wilcox <willy@infradead.org>
    cc: Christoph Hellwig <hch@infradead.org>
    cc: netfs@lists.linux.dev
    cc: linux-fsdevel@vger.kernel.org

diff --git a/fs/netfs/internal.h b/fs/netfs/internal.h
index d889caa401dc..420ee7b26580 100644
--- a/fs/netfs/internal.h
+++ b/fs/netfs/internal.h
@@ -43,6 +43,7 @@ extern struct list_head netfs_io_requests;
 extern spinlock_t netfs_proc_lock;
 extern mempool_t netfs_request_pool;
 extern mempool_t netfs_subrequest_pool;
+extern mempool_t netfs_folioq_pool;
 
 #ifdef CONFIG_PROC_FS
 static inline void netfs_proc_add_rreq(struct netfs_io_request *rreq)
diff --git a/fs/netfs/main.c b/fs/netfs/main.c
index 73da6c9f5777..927badf3989d 100644
--- a/fs/netfs/main.c
+++ b/fs/netfs/main.c
@@ -28,6 +28,7 @@ static struct kmem_cache *netfs_request_slab;
 static struct kmem_cache *netfs_subrequest_slab;
 mempool_t netfs_request_pool;
 mempool_t netfs_subrequest_pool;
+mempool_t netfs_folioq_pool;
 
 #ifdef CONFIG_PROC_FS
 LIST_HEAD(netfs_io_requests);
@@ -108,6 +109,9 @@ static int __init netfs_init(void)
 {
 	int ret = -ENOMEM;
 
+	if (mempool_init_kmalloc_pool(&netfs_folioq_pool, 100, sizeof(struct folio_queue)) < 0)
+		goto error_folioq_pool;
+
 	netfs_request_slab = kmem_cache_create("netfs_request",
 					       sizeof(struct netfs_io_request), 0,
 					       SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT,
@@ -160,6 +164,8 @@ static int __init netfs_init(void)
 error_reqpool:
 	kmem_cache_destroy(netfs_request_slab);
 error_req:
+	mempool_exit(&netfs_folioq_pool);
+error_folioq_pool:
 	return ret;
 }
 fs_initcall(netfs_init);
@@ -172,5 +178,6 @@ static void __exit netfs_exit(void)
 	kmem_cache_destroy(netfs_subrequest_slab);
 	mempool_exit(&netfs_request_pool);
 	kmem_cache_destroy(netfs_request_slab);
+	mempool_exit(&netfs_folioq_pool);
 }
 module_exit(netfs_exit);
diff --git a/fs/netfs/rolling_buffer.c b/fs/netfs/rolling_buffer.c
index a17fbf9853a4..48052d77567b 100644
--- a/fs/netfs/rolling_buffer.c
+++ b/fs/netfs/rolling_buffer.c
@@ -27,7 +27,7 @@ struct folio_queue *netfs_folioq_alloc(unsigned int rreq_id, gfp_t gfp,
 {
 	struct folio_queue *fq;
 
-	fq = kmalloc_obj(*fq, gfp);
+	fq = mempool_alloc(&netfs_folioq_pool, gfp);
 	if (fq) {
 		netfs_stat(&netfs_n_folioq);
 		folioq_init(fq, rreq_id);
@@ -50,7 +50,7 @@ void netfs_folioq_free(struct folio_queue *folioq,
 {
 	trace_netfs_folioq(folioq, trace);
 	netfs_stat_d(&netfs_n_folioq);
-	kfree(folioq);
+	mempool_free(folioq, &netfs_folioq_pool);
 }
 EXPORT_SYMBOL(netfs_folioq_free);
 

Re: [PATCH v2] netfs: fix writeback ENOMEM by using __GFP_NOFAIL for rolling buffer

[Zhou, Yun]

On 7/27/26 18:03, David Howells wrote:
> Yun Zhou <yun.zhou@windriver.com> wrote:
> 
>> rolling_buffer_init() uses plain GFP_NOFS for its folio_queue allocation.
>> In the writeback path this can fail and trigger WARN_ON_ONCE(folio != NULL)
>> in netfs_writepages() when writeback_iter() returns additional dirty folios
>> left unhandled.
>>
>> Writeback must not fail with -ENOMEM. Fix this by adding a gfp_t parameter
>> to rolling_buffer_init() and passing GFP_NOFS | __GFP_NOFAIL from the
>> writeback path, ensuring the allocation always succeeds. Read paths
>> continue to use plain GFP_NOFS.
> 
> I don't think this is the correct solution.  I think you're right that a gfp_t
> needs to be passed into rolling_buffer*(), but I think we need a mempool as
> well.
> 
> I have most of the patch for that, but I think I need adjust things so that
> the read path uses GFP_KERNEL, not GFP_NOFS.
> 

Got it. Your mempool approach looks good. Please let me know if you need 
anything from me.

BR,
Yun