From: Jaegeuk Kim <jaegeuk@kernel.org>
To: Wenjie Qi <qwjhust@gmail.com>
Cc: chao@kernel.org, geoo115@gmail.com, yangyongpeng@xiaomi.com,
linux-kernel@vger.kernel.org, stable@vger.kernel.org,
linux-f2fs-devel@lists.sourceforge.net, qiwenjie@xiaomi.com
Subject: Re: [f2fs-dev] [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup
Date: Wed, 17 Jun 2026 18:09:34 +0000 [thread overview]
Message-ID: <ajLi3nLqyS31Y6J4@google.com> (raw)
In-Reply-To: <20260616135637.1439319-1-qiwenjie@xiaomi.com>
On 06/16, Wenjie Qi wrote:
> f2fs_write_end_io() decrements the writeback page counter and then
> reads it again with get_pages() to decide whether the last
> F2FS_WB_CP_DATA completion should wake cp_wait.
>
> Use atomic_dec_return() for F2FS_WB_CP_DATA completions so the wakeup
> decision is made from the value produced by the decrement itself. Keep
> the existing dec_page_count() path for other writeback counters.
Is there a race condition to do this? If so, can you describe? And, I think
we need a wrapper function instead of calling nr_pages directly.
>
> Fixes: e234088758fc ("f2fs: avoid wait if IO end up when do_checkpoint for better performance")
> Fixes: ce2739e482bc ("f2fs: fix to avoid UAF in f2fs_write_end_io()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
> ---
> fs/f2fs/data.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
> index d83a21998ec2..58d23eb74ec2 100644
> --- a/fs/f2fs/data.c
> +++ b/fs/f2fs/data.c
> @@ -392,15 +392,17 @@ static void f2fs_write_end_io(struct bio *bio)
> if (f2fs_in_warm_node_list(folio))
> f2fs_del_fsync_node_entry(sbi, folio);
>
> - dec_page_count(sbi, type);
> -
> /*
> * we should access sbi before folio_end_writeback() to
> * avoid racing w/ kill_f2fs_super()
> */
> - if (type == F2FS_WB_CP_DATA && !get_pages(sbi, type) &&
> - wq_has_sleeper(&sbi->cp_wait))
> - wake_up(&sbi->cp_wait);
> + if (type == F2FS_WB_CP_DATA) {
> + if (!atomic_dec_return(&sbi->nr_pages[type]) &&
> + wq_has_sleeper(&sbi->cp_wait))
> + wake_up(&sbi->cp_wait);
> + } else {
> + dec_page_count(sbi, type);
> + }
>
> folio_clear_f2fs_gcing(folio);
> folio_end_writeback(folio);
>
> base-commit: c0b65f6129c7fbb526e921dd60261650f1b2bef9
> --
> 2.43.0
>
>
>
> _______________________________________________
> Linux-f2fs-devel mailing list
> Linux-f2fs-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: Jaegeuk Kim via Linux-f2fs-devel <linux-f2fs-devel@lists.sourceforge.net>
To: Wenjie Qi <qwjhust@gmail.com>
Cc: geoo115@gmail.com, yangyongpeng@xiaomi.com,
linux-kernel@vger.kernel.org, stable@vger.kernel.org,
linux-f2fs-devel@lists.sourceforge.net, qiwenjie@xiaomi.com
Subject: Re: [f2fs-dev] [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup
Date: Wed, 17 Jun 2026 18:09:34 +0000 [thread overview]
Message-ID: <ajLi3nLqyS31Y6J4@google.com> (raw)
In-Reply-To: <20260616135637.1439319-1-qiwenjie@xiaomi.com>
On 06/16, Wenjie Qi wrote:
> f2fs_write_end_io() decrements the writeback page counter and then
> reads it again with get_pages() to decide whether the last
> F2FS_WB_CP_DATA completion should wake cp_wait.
>
> Use atomic_dec_return() for F2FS_WB_CP_DATA completions so the wakeup
> decision is made from the value produced by the decrement itself. Keep
> the existing dec_page_count() path for other writeback counters.
Is there a race condition to do this? If so, can you describe? And, I think
we need a wrapper function instead of calling nr_pages directly.
>
> Fixes: e234088758fc ("f2fs: avoid wait if IO end up when do_checkpoint for better performance")
> Fixes: ce2739e482bc ("f2fs: fix to avoid UAF in f2fs_write_end_io()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
> ---
> fs/f2fs/data.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
> index d83a21998ec2..58d23eb74ec2 100644
> --- a/fs/f2fs/data.c
> +++ b/fs/f2fs/data.c
> @@ -392,15 +392,17 @@ static void f2fs_write_end_io(struct bio *bio)
> if (f2fs_in_warm_node_list(folio))
> f2fs_del_fsync_node_entry(sbi, folio);
>
> - dec_page_count(sbi, type);
> -
> /*
> * we should access sbi before folio_end_writeback() to
> * avoid racing w/ kill_f2fs_super()
> */
> - if (type == F2FS_WB_CP_DATA && !get_pages(sbi, type) &&
> - wq_has_sleeper(&sbi->cp_wait))
> - wake_up(&sbi->cp_wait);
> + if (type == F2FS_WB_CP_DATA) {
> + if (!atomic_dec_return(&sbi->nr_pages[type]) &&
> + wq_has_sleeper(&sbi->cp_wait))
> + wake_up(&sbi->cp_wait);
> + } else {
> + dec_page_count(sbi, type);
> + }
>
> folio_clear_f2fs_gcing(folio);
> folio_end_writeback(folio);
>
> base-commit: c0b65f6129c7fbb526e921dd60261650f1b2bef9
> --
> 2.43.0
>
>
>
> _______________________________________________
> Linux-f2fs-devel mailing list
> Linux-f2fs-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
next prev parent reply other threads:[~2026-06-17 18:09 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-16 13:56 [f2fs-dev] [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup Wenjie Qi
2026-06-16 13:56 ` Wenjie Qi
2026-06-17 18:09 ` Jaegeuk Kim [this message]
2026-06-17 18:09 ` [f2fs-dev] " Jaegeuk Kim via Linux-f2fs-devel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ajLi3nLqyS31Y6J4@google.com \
--to=jaegeuk@kernel.org \
--cc=chao@kernel.org \
--cc=geoo115@gmail.com \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=qiwenjie@xiaomi.com \
--cc=qwjhust@gmail.com \
--cc=stable@vger.kernel.org \
--cc=yangyongpeng@xiaomi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.