From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.sourceforge.net (lists.sourceforge.net [216.105.38.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A03BBCF6BE4 for ; Wed, 7 Jan 2026 02:20:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: Reply-To:From:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Subject:MIME-Version:Message-ID:Date:To:Sender:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=jQk9a+b0SC01ixV8HwxSMHec1FSsJakWtPaj3bqu8yA=; b=avWyZYv8mH9U3ZJa8cJzvnrAxc nudpzwAHvBYiTQDOhrzoq6vrmkZV/zzcYDOy3wR6JyfXUp6mhl8rLBhh2Dtn72jntVK87z4FuHPz6 ESDu0BOKOh9IBYn9nYMThOnjC3yQI1o9N0TH8f2f2MGx7hFjKfdvITYjWEsZq/36w+Os=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1vdJA5-0000rj-2t; Wed, 07 Jan 2026 02:20:37 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1vdJA4-0000rd-4z for linux-f2fs-devel@lists.sourceforge.net; Wed, 07 Jan 2026 02:20:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=MIME-Version:Content-Transfer-Encoding:Content-Type :Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=QXQSWiRjJ0G+Iu3JgdzaERv4v+dS6FQZgqDAP6Twg+s=; b=fjlFtQDYGI/VOt9igWfUA4sXq5 89ldbLZqKC0cS4bx08lYdSRzTo52EIam1r3+RA/+qe/soCqRwCtC+gR2jKn6g7HEF8NVuU2xQmnoo 33iZFaJA58aAkuIqJ+OgYN3xx268FcttTX+5YHXGb6YQMNXaxcKxhh+M5hREhimqfr0Y=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=MIME-Version:Content-Transfer-Encoding:Content-Type:Message-ID:Date: Subject:To:From:Sender:Reply-To:Cc:Content-ID:Content-Description:Resent-Date :Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post: List-Owner:List-Archive; bh=QXQSWiRjJ0G+Iu3JgdzaERv4v+dS6FQZgqDAP6Twg+s=; b=D nHb3xOFJHIOB30ovtfDt9ylfQsm5HQAelK80BnnHjCwgbADP76X0PZxeH5gOnyu5SJC82yrAM/16n 89S4O6EhtSx7eJj5luiSZf8inqbozjBFU8PhPHmfmYkVPA1cAMdvHJnY4mxwUD31GsqEbCWdkKEgD PdCXiaMudXTpUzbA=; Received: from tor.source.kernel.org ([172.105.4.254]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1vdJA3-000289-Ie for linux-f2fs-devel@lists.sourceforge.net; Wed, 07 Jan 2026 02:20:36 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id 01F616013A for ; Wed, 7 Jan 2026 02:20:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPS id AAE88C16AAE for ; Wed, 7 Jan 2026 02:20:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1767752424; bh=hSmGarCor0HWthr0MpWaj+4bAtDahkM7Fqd2qkkBzpM=; h=From:To:Subject:Date:From; b=Twh5QdVMREYtJwf4ZDBMsVXW7CW2pd7dIgaUXO6z2VFPbGTQMAY7u98Mw+jYN++x0 iY9sgEumIhEBeNYzqDS+OM/0WMA+duy3xITkjB0I5GnKg4pW/V1N4nbW4/FgY5lh0K 5B72nDTxCUV7nh+t/jEqxD0wqY7yfZLt5N69xp2kdNAOWWM7PG69W8VCHBcSlLDAC1 77puwvVvXQvX0sSRhVqampLrVguXyT/A7WbX7dvMMnpRJHdnrBO7+ozkjE1IVc2KF3 CyCY70rvfVqrleACtEqXROj4HbsXAZuTln7mAWouoxeDQQ54TqN1jmgroQDpXGQX9P Oe0ywMCMsFTZg== Received: by aws-us-west-2-korg-bugzilla-1.web.codeaurora.org (Postfix, from userid 48) id 9AA0EC4160E; Wed, 7 Jan 2026 02:20:24 +0000 (UTC) To: linux-f2fs-devel@lists.sourceforge.net Date: Wed, 07 Jan 2026 02:20:24 +0000 X-Bugzilla-Reason: None X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: AssignedTo filesystem_f2fs@kernel-bugs.kernel.org X-Bugzilla-Product: File System X-Bugzilla-Component: f2fs X-Bugzilla-Version: 2.5 X-Bugzilla-Keywords: X-Bugzilla-Severity: high X-Bugzilla-Who: guoxiaolong2008@gmail.com X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: filesystem_f2fs@kernel-bugs.kernel.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter cf_regression Message-ID: X-Bugzilla-URL: https://bugzilla.kernel.org/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-Headers-End: 1vdJA3-000289-Ie Subject: [f2fs-dev] [Bug 220951] New: swapfile activation bug causes data corruption when swapfile < 2MB with fragmented extents X-BeenThere: linux-f2fs-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: bugzilla-daemon--- via Linux-f2fs-devel Reply-To: bugzilla-daemon@kernel.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: linux-f2fs-devel-bounces@lists.sourceforge.net https://bugzilla.kernel.org/show_bug.cgi?id=220951 Bug ID: 220951 Summary: swapfile activation bug causes data corruption when swapfile < 2MB with fragmented extents Product: File System Version: 2.5 Hardware: ARM OS: Linux Status: NEW Severity: high Priority: P3 Component: f2fs Assignee: filesystem_f2fs@kernel-bugs.kernel.org Reporter: guoxiaolong2008@gmail.com Regression: No When using stress-ng's swap stress test on F2FS filesystem with kernel 6.6+, the system experiences data corruption leading to either: 1 dm-verity corruption errors and device reboot 2 F2FS node corruption errors and boot hangs The issue occurs specifically when: 1 Using F2FS filesystem (ext4 is unaffected) 2 Swapfile size is less than F2FS section size (2MB) 3 Swapfile has fragmented physical layout (multiple non-contiguous extents) 4 Kernel version is 6.6+ (6.1 is unaffected) The root cause is in check_swap_activate() function in fs/f2fs/data.c. When the first extent of a small swapfile (< 2MB) is not aligned to section boundaries, the function incorrectly treats it as the last extent, failing to map subsequent extents. This results in incorrect swap_extent creation where only the first extent is mapped, causing subsequent swap writes to overwrite wrong physical locations (other files' data). Steps to Reproduce 1 Setup a device with F2FS-formatted userdata partition 2 Compile stress-ng from https://github.com/ColinIanKing/stress-ng 3 Run swap stress test: (Android devices) adb shell "cd /data/stressng; ./stress-ng-64 --metrics-brief --timeout 60 --swap 0" Log: 1 Ftrace shows in kernel 6.6, only first extent is mapped during second f2fs_map_blocks call in check_swap_activate(): stress-ng-swap-8990: f2fs_map_blocks: ino=11002, file offset=0, start blkaddr=0x43143, len=0x1 (Only 4KB mapped, not the full swapfile) 2 in kernel 6.1, both extents are correctly mapped: stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=0, start blkaddr=0x13cd4, len=0x1 stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=1, start blkaddr=0x60c84b, len=0xff The problematic code is in check_swap_activate(): if ((pblock - SM_I(sbi)->main_blkaddr) % blks_per_sec || nr_pblocks % blks_per_sec || !f2fs_valid_pinned_area(sbi, pblock)) { bool last_extent = false; not_aligned++; nr_pblocks = roundup(nr_pblocks, blks_per_sec); if (cur_lblock + nr_pblocks > sis->max) nr_pblocks -= blks_per_sec; /* this extent is last one */ if (!nr_pblocks) { nr_pblocks = last_lblock - cur_lblock; last_extent = true; } ret = f2fs_migrate_blocks(inode, cur_lblock, nr_pblocks); if (ret) { if (ret == -ENOENT) ret = -EINVAL; goto out; } if (!last_extent) goto retry; } When the first extent is unaligned and roundup(nr_pblocks, blks_per_sec) exceeds sis->max, we subtract blks_per_sec resulting in nr_pblocks = 0. The code then incorrectly assumes this is the last extent, sets nr_pblocks = last_lblock - cur_lblock (entire swapfile), and performs migration. After migration, it doesn't retry mapping, so subsequent extents are never processed. Only one swap_extent is created starting at the first extent's physical block. Subsequent swap writes use incorrect sector calculations, overwriting other files' data. -- You may reply to this email to add a comment. You are receiving this mail because: You are watching the assignee of the bug. _______________________________________________ Linux-f2fs-devel mailing list Linux-f2fs-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel