Re: [PATCH 1/3] iomap: don't resubmit an ioend after ->writeback_submit() failed

[Christoph Hellwig]

On Mon, Sep 21, 2026 at 10:31:31AM +0200, Andrea Parri wrote:
> For XFS the second bio_endio() lands in xfs_end_bio(), which
> list_add_tail()s the already linked ioend into ip->i_ioend_list.  This
> corrupts the list and leaves a use-after-free/double-free window against
> the ioend completion worker.

Do you have a reproducer for this using some kind of error injection?

>  		if (ioend) {
>  			error = wpc->ops->writeback_submit(wpc, 0);
> -			if (error)
> +			if (error) {
> +				/*
> +				 * ->writeback_submit() completed the ioend with
> +				 * an error, so drop the stale context.
> +				 * iomap_writepages() would otherwise submit it a

Overly long line here.