From: Daeho Jeong <daehojeong@google.com>

truncate_inode_pages_final() is meant to be called from ->evict_inode.
It sets AS_EXITING on the mapping, and nothing ever clears it, to tell
the VM that the inode is going away.

f2fs calls it in two places where the inode stays live:

 - F2FS_IOC_START_ATOMIC_REPLACE uses it to drop the page cache of the
   original inode before setting i_size to 0. The atomic write then
   goes on through this inode.

 - f2fs_abort_atomic_write() uses it to drop the uncommitted data. It
   is called on eviction, but also on the last writer's close in
   f2fs_release_file(), from f2fs_file_flush() when the atomic writer
   exits, from F2FS_IOC_ABORT_ATOMIC_WRITE and when
   F2FS_IOC_COMMIT_ATOMIC_WRITE fails.

Other processes may still have the file open or mapped in all of these
cases. The mapping then stays marked as exiting for as long as the
inode is in memory. This stops reclaim from storing workingset shadow
entries for it and breaks any code that assumes an exiting mapping has
no users left.

All we need in both places is to drop the page cache, so use
truncate_inode_pages(mapping, 0) instead. The eviction path is not
affected, because f2fs_pre_evict_inode() still calls
truncate_inode_pages_final() after f2fs_abort_atomic_write().

Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
Fixes: 41e8f85a75fc ("f2fs: introduce F2FS_IOC_START_ATOMIC_REPLACE")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
---
 fs/f2fs/file.c    | 2 +-
 fs/f2fs/segment.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 7020b3e8940..1e6f1f02357 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2466,7 +2466,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
 	fi->original_i_size = isize;
 	if (truncate) {
 		set_inode_flag(inode, FI_ATOMIC_REPLACE);
-		truncate_inode_pages_final(inode->i_mapping);
+		truncate_inode_pages(inode->i_mapping, 0);
 		f2fs_i_size_write(inode, 0);
 		isize = 0;
 	}
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 794e0d99fc7..781995fedcc 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -194,7 +194,7 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)
 		return;
 
 	if (clean)
-		truncate_inode_pages_final(inode->i_mapping);
+		truncate_inode_pages(inode->i_mapping, 0);
 
 	release_atomic_write_cnt(inode);
 	clear_inode_flag(inode, FI_ATOMIC_COMMITTED);
-- 
2.56.0.385.gd3acb90ef8-goog

On 10/16/26 00:17, Daeho Jeong wrote:
> From: Daeho Jeong <daehojeong@google.com>
> 
> truncate_inode_pages_final() is meant to be called from ->evict_inode.
> It sets AS_EXITING on the mapping, and nothing ever clears it, to tell
> the VM that the inode is going away.
> 
> f2fs calls it in two places where the inode stays live:
> 
>  - F2FS_IOC_START_ATOMIC_REPLACE uses it to drop the page cache of the
>    original inode before setting i_size to 0. The atomic write then
>    goes on through this inode.
> 
>  - f2fs_abort_atomic_write() uses it to drop the uncommitted data. It
>    is called on eviction, but also on the last writer's close in
>    f2fs_release_file(), from f2fs_file_flush() when the atomic writer
>    exits, from F2FS_IOC_ABORT_ATOMIC_WRITE and when
>    F2FS_IOC_COMMIT_ATOMIC_WRITE fails.
> 
> Other processes may still have the file open or mapped in all of these
> cases. The mapping then stays marked as exiting for as long as the
> inode is in memory. This stops reclaim from storing workingset shadow
> entries for it and breaks any code that assumes an exiting mapping has
> no users left.
> 
> All we need in both places is to drop the page cache, so use
> truncate_inode_pages(mapping, 0) instead. The eviction path is not
> affected, because f2fs_pre_evict_inode() still calls
> truncate_inode_pages_final() after f2fs_abort_atomic_write().
> 

Cc: stable@kernel.org

> Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
> Fixes: 41e8f85a75fc ("f2fs: introduce F2FS_IOC_START_ATOMIC_REPLACE")
> Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>

Thanks,