[PATCH] f2fs: only redirty pinned folios in redirty_blocks

[PATCH] f2fs: only redirty pinned folios in redirty_blocks

[Wenjie Qi]

redirty_blocks() pins folios with read_cache_folio() and then walks the
same range again with filemap_lock_folio() to redirty them and drop the
references it took.

Commit 5951fee46bef ("f2fs: Use a folio in redirty_blocks()") changed
the second pass to a do/while loop. If read_cache_folio() fails before
anything is pinned, page_idx does not advance but the cleanup loop still
runs once.

If readahead has already populated the failed folio in page cache, that
extra iteration finds it and folio_put_refs(folio, 2) drops one
reference too many. Later drop_caches or reclaim can then report
"BUG: Bad page state".

Only redirty the range that was pinned successfully.

Fixes: 5951fee46bef ("f2fs: Use a folio in redirty_blocks()")
Cc: stable@kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
---
Observed on the baseline after a FAULT_READ_IO-triggered
F2FS_IOC_COMPRESS_FILE:
  BUG: Bad page state in process bash  pfn:1190b0
  aops:f2fs_dblock_aops ino:5 dentry name(?):"redirty"
  page dumped because: non-NULL mapping
  Call Trace:
   dump_stack_lvl+0x53/0x70
   bad_page+0xd4/0x220
   free_unref_folios+0x72a/0x1320
   folios_put_refs+0x348/0x590
   mapping_try_invalidate+0x236/0x2d0
   drop_pagecache_sb+0x116/0x330
   __iterate_supers+0x183/0x200
   drop_caches_sysctl_handler+0x72/0x110
   proc_sys_call_handler+0x352/0x540
   vfs_write+0x5f8/0xf50
   ksys_write+0xf9/0x1d0
   do_syscall_64+0x5f/0x550
   entry_SYSCALL_64_after_hwframe+0x71/0x79

 fs/f2fs/file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index c54897a25981..bb89dd738e96 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -4479,7 +4479,7 @@ static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len)
 		page_idx = folio_next_index(folio);
 	} while (page_len < len);
 
-	do {
+	while (redirty_idx < page_idx) {
 		folio = filemap_lock_folio(mapping, redirty_idx);
 
 		/* It will never fail, when folio has pinned above */
@@ -4492,7 +4492,7 @@ static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len)
 		redirty_idx = folio_next_index(folio);
 		folio_unlock(folio);
 		folio_put_refs(folio, 2);
-	} while (redirty_idx < page_idx);
+	}
 
 	return ret;
 }
-- 
2.43.0

Re: [PATCH] f2fs: only redirty pinned folios in redirty_blocks

[Chao Yu]

On 7/27/26 21:04, Wenjie Qi wrote:
> redirty_blocks() pins folios with read_cache_folio() and then walks the
> same range again with filemap_lock_folio() to redirty them and drop the
> references it took.
> 
> Commit 5951fee46bef ("f2fs: Use a folio in redirty_blocks()") changed
> the second pass to a do/while loop. If read_cache_folio() fails before
> anything is pinned, page_idx does not advance but the cleanup loop still
> runs once.
> 
> If readahead has already populated the failed folio in page cache, that
> extra iteration finds it and folio_put_refs(folio, 2) drops one
> reference too many. Later drop_caches or reclaim can then report
> "BUG: Bad page state".
> 
> Only redirty the range that was pinned successfully.
> 
> Fixes: 5951fee46bef ("f2fs: Use a folio in redirty_blocks()")
> Cc: stable@kernel.org
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>

Reviewed-by: Chao Yu <chao@kernel.org>

Thanks,

Re: [f2fs-dev] [PATCH] f2fs: only redirty pinned folios in redirty_blocks

[patchwork-bot+f2fs]

Hello:

This patch was applied to jaegeuk/f2fs.git (dev)
by Jaegeuk Kim <jaegeuk@kernel.org>:

On Mon, 27 Jul 2026 21:04:29 +0800 you wrote:
> redirty_blocks() pins folios with read_cache_folio() and then walks the
> same range again with filemap_lock_folio() to redirty them and drop the
> references it took.
> 
> Commit 5951fee46bef ("f2fs: Use a folio in redirty_blocks()") changed
> the second pass to a do/while loop. If read_cache_folio() fails before
> anything is pinned, page_idx does not advance but the cleanup loop still
> runs once.
> 
> [...]

Here is the summary with links:
  - [f2fs-dev] f2fs: only redirty pinned folios in redirty_blocks
    https://git.kernel.org/jaegeuk/f2fs/c/85171332742e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html