Re: [PATCH] xfs: restore nofs context unconditionally in xfs_trans_roll

[Christoph Hellwig]

On Mon, Jul 13, 2026 at 11:55:05AM +0800, Yun Zhou wrote:
> When __xfs_trans_commit() fails in xfs_trans_roll(), the NOFS context
> is cleared but only restored in the success path.  This leaves the
> error path without nofs protection, causing a circular lock dependency
> between xfs_nondir_ilock_class and fs_reclaim:
> 
>        CPU0                    CPU1
>        ----                    ----
>   lock(&xfs_nondir_ilock_class);
>                                lock(fs_reclaim);
>                                lock(&xfs_nondir_ilock_class);
>   lock(fs_reclaim);
> 
> Fix this by moving xfs_trans_set_context() before the error check so
> that nofs context is always restored on the new transaction.
> 
> Reported-by: syzbot+59178abfeb0ea3f0ab20@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=59178abfeb0ea3f0ab20
> Fixes: a1ca658d649a ("xfs: fix incorrect context handling in xfs_trans_roll")
> Signed-off-by: Yun Zhou <yun.zhou@xxxxxxxxxxxxx>
> ---
>  fs/xfs/xfs_trans.c | 16 +++++++++-------
>  1 file changed, 9 insertions(+), 7 deletions(-)
> 
> diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
> index 7bfbd9f6f0df..1b36cf12d4e3 100644
> --- a/fs/xfs/xfs_trans.c
> +++ b/fs/xfs/xfs_trans.c
> @@ -1029,6 +1029,15 @@ xfs_trans_roll(
>  	 * duplicate transaction that gets returned.
>  	 */
>  	error = __xfs_trans_commit(tp, true);
> +
> +	tp = *tpp;
> +	/*
> +	 * __xfs_trans_commit cleared the NOFS flag by calling into
> +	 * xfs_trans_free.  Set it again here before doing memory
> +	 * allocations.
> +	 */
> +	xfs_trans_set_context(tp);

The tp assignment above now returns the incorrect transaction when
__xfs_trans_commit fails, so you can't do this.

Otherwise yes, this call should move up.  I don't really see how
it fixes the syzbot report, though.