Forwarded: [PATCH] f2fs: fix hung task in block_operations during checkpoint

[syzbot <syzbot+4235e4d7b6fd75704528@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH]   f2fs: fix hung task in block_operations during checkpoint
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

        f2fs_sync_inode_meta() can return 0 (success) even when
        f2fs_update_inode_page() fails and triggers f2fs_stop_checkpoint().
        This happens because the error flag check only occurs at the start
        of each loop iteration, not after f2fs_update_inode_page() returns.

        When I/O errors occur:
        1. f2fs_update_inode_page() retries 8 times then calls
           f2fs_stop_checkpoint(), which sets CP_ERROR_FLAG
        2. f2fs_sync_inode_meta() returns 0 without checking the error flag
        3. block_operations() sees success and loops back to retry_flush_quotas
        4. Dirty inodes remain on list (sync failed), loop repeats forever
        5. Checkpoint never completes, waiters block indefinitely

        This causes hung tasks when operations like unlink wait for checkpoint
        completion while holding locks that other tasks need.

        Fix by checking f2fs_cp_error() after processing each inode in
        f2fs_sync_inode_meta() to detect errors from f2fs_update_inode_page().

        Reported-by: syzbot+4235e4d7b6fd75704528@syzkaller.appspotmail.com
        Closes: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
        Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 fs/f2fs/inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index f1cda1900658..7cd0ac088f68 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -763,6 +763,8 @@ void f2fs_update_inode_page(struct inode *inode)
 	struct folio *node_folio;
 	int count = 0;
 retry:
+	if (unlikely(f2fs_cp_error(sbi)))
+		return ;
 	node_folio = f2fs_get_inode_folio(sbi, inode->i_ino);
 	if (IS_ERR(node_folio)) {
 		int err = PTR_ERR(node_folio);
-- 
2.43.0