syzbot reported a hung task in nilfs_transaction_begin(). This occurs
because the cleaner ioctl falls into an infinite loop if
nilfs_segctor_construct() repeatedly returns -EROFS (e.g. the device
is remounted as read-only after an I/O error).

Currently in nilfs_clean_segments(), if err is non-zero, it logs the
error and sleeps but doesn't abort when it encounters a terminal error
like -EROFS. This causes the thread to loop forever.

Fix this by breaking out of the loop if nilfs_segctor_construct()
returns -EROFS. This matches the behaviour in
nilfs_segctor_write_out(), which also handles -EROFS.

Reported-by: syzbot+cae54346a70bbceeff2c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cae54346a70bbceeff2c
Fixes: 9ff05123e3bf ("nilfs2: segment constructor")
Assisted-by: gemini:gemini-3.1-pro
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
---
Changes in v2:
- use `goto out_unlock` instead of break to prevent discard commands
  from being sent

As much as I've tried, syzbot is unable to test this and always fails
with "FATAL: Kernel too old". Nevertheless, I've tested the patch with
the same reproducer in QEMU and the system didn't hang.
---
 fs/nilfs2/segment.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 9332f5ac6..218926789 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2561,6 +2561,10 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
 			break;
 
 		nilfs_warn(sb, "error %d cleaning segments", err);
+
+		if (unlikely(err == -EROFS))
+			goto out_unlock;
+
 		set_current_state(TASK_INTERRUPTIBLE);
 		schedule_timeout(sci->sc_interval);
 	}
-- 
2.47.3

On Fri, Jul 17, 2026 at 7:59 PM Joshua Crofts wrote:
>
> syzbot reported a hung task in nilfs_transaction_begin(). This occurs
> because the cleaner ioctl falls into an infinite loop if
> nilfs_segctor_construct() repeatedly returns -EROFS (e.g. the device
> is remounted as read-only after an I/O error).
>
> Currently in nilfs_clean_segments(), if err is non-zero, it logs the
> error and sleeps but doesn't abort when it encounters a terminal error
> like -EROFS. This causes the thread to loop forever.
>
> Fix this by breaking out of the loop if nilfs_segctor_construct()
> returns -EROFS. This matches the behaviour in
> nilfs_segctor_write_out(), which also handles -EROFS.
>
> Reported-by: syzbot+cae54346a70bbceeff2c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=cae54346a70bbceeff2c
> Fixes: 9ff05123e3bf ("nilfs2: segment constructor")
> Assisted-by: gemini:gemini-3.1-pro
> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> ---
> Changes in v2:
> - use `goto out_unlock` instead of break to prevent discard commands
>   from being sent
>
> As much as I've tried, syzbot is unable to test this and always fails
> with "FATAL: Kernel too old". Nevertheless, I've tested the patch with
> the same reproducer in QEMU and the system didn't hang.
> ---
>  fs/nilfs2/segment.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
> index 9332f5ac6..218926789 100644
> --- a/fs/nilfs2/segment.c
> +++ b/fs/nilfs2/segment.c
> @@ -2561,6 +2561,10 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
>                         break;
>
>                 nilfs_warn(sb, "error %d cleaning segments", err);
> +
> +               if (unlikely(err == -EROFS))
> +                       goto out_unlock;
> +
>                 set_current_state(TASK_INTERRUPTIBLE);
>                 schedule_timeout(sci->sc_interval);
>         }
> --
> 2.47.3

Looks good.

Viacheslav, could you please pick this up for your queue?

Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>

Thanks,
Ryusuke Konishi