From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f70.google.com (mail-oo1-f70.google.com [209.85.161.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E5DD78F2E for ; Sat, 6 Dec 2025 06:26:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.70 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765002413; cv=none; b=HCf0cHyHyRNZ8i5igsmi6RjV50YsWLOBadYGBqjUtpwoWgk7uXoDZsCm5XtgH3ehIz+vvXBnEipWVmFg9IAbvJU3yVH0VwhpSPAoKY/L8tjqeTXvK7dpdQnm+coScFgMasvEJ4ZKxurbyg0nn4ePRq9z1+6ou6VbS24cGn7+Xas= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765002413; c=relaxed/simple; bh=w8V+vYogxLwep9Q9Mp+x0aaGVk/zIZN5AUNSucgbZZM=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=Z5meq4SsmpiEK2NwCCOQ5NvpnQ/vocueoDlqphsJTmzd8i2NZo3wyAaWns79ZgN3AW+XjSNFIZZ1E64S9R3NFa6KpWUOkvOt6THZPXTMtF4Ad0pcl3aHRrzgkY3MQYCgxGLYPqQkBNlXnNXtlCZK5A+fyRChhiruBBcsBYMRHx8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f70.google.com with SMTP id 006d021491bc7-6574d366132so1988011eaf.0 for ; Fri, 05 Dec 2025 22:26:51 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765002410; x=1765607210; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=Wiw48K3Txx94wM1ZL47yaUht3EU8LPmtrZTzp7n4dWI=; b=MxelJdrQsCOqF0qJSBSQBd4IlGDe0FcmvElP3dscHuxdy6Gyf46nV0NtoSg4Efvh9z pSs2IuFm1DVmVXxYMbLrPSPaTiGVSA3eB9msUEAKoqSvgOspZIwApYjSuD747/cDfQtP f81HyMmelSH03MScbjDCZ6YGrxClWT4tJn4bWN/ZD0HJxL/6i2zT9PiHPT0XoKnCSSi4 FupNO68IT7Jqh5oWY6BNtCVcx978Qxreuuo8H0mYr7eoMgjHKLv4CUZjNLuVVA9GtdHC o86mR+nlbpRbvOVC8JtG9c/zpSV+oHbKKJgkFTJ5O3mVCvsQA69tHBXVl3ZMBVXEU9of xYyg== X-Gm-Message-State: AOJu0YwOBpfU+ZAUv5viUPLly4B4u4RpXiXljQYCSXGs9DNSGQe8LYbe 3OHu4fqSLYbOyTJo1XNF52pyUKgUHTDUtmmwiIeWBWjplXHUL8EOcCBKz1UTvOUTGi6nqNVyzwD /znAH94VpyNORJqoPSzVySWez2eqiMhpMKEJ+tuUwhXag/82/abv5vdzhBD0= X-Google-Smtp-Source: AGHT+IGih/zxue29HUSUQQv+aHn8Vs5ITNCGqCCLQ2RtmnYB8RYdfnMWrH4XEAMtylh6hND0eb3p2Mv714nCKaVS6bV5wljd3+LE Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:216:b0:659:9a49:8e52 with SMTP id 006d021491bc7-6599a90a7bbmr745668eaf.34.1765002410684; Fri, 05 Dec 2025 22:26:50 -0800 (PST) Date: Fri, 05 Dec 2025 22:26:50 -0800 In-Reply-To: <69332cf9.a70a0220.243dc6.0011.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6933ccaa.a70a0220.38f243.0013.GAE@google.com> Subject: Forwarded: [PATCH] f2fs: fix hung task in block_operations during checkpoint From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] f2fs: fix hung task in block_operations during checkpoint Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master f2fs_sync_inode_meta() can return 0 (success) even when f2fs_update_inode_page() fails and triggers f2fs_stop_checkpoint(). This happens because the error flag check only occurs at the start of each loop iteration, not after f2fs_update_inode_page() returns. When I/O errors occur: 1. f2fs_update_inode_page() retries 8 times then calls f2fs_stop_checkpoint(), which sets CP_ERROR_FLAG 2. f2fs_sync_inode_meta() returns 0 without checking the error flag 3. block_operations() sees success and loops back to retry_flush_quotas 4. Dirty inodes remain on list (sync failed), loop repeats forever 5. Checkpoint never completes, waiters block indefinitely This causes hung tasks when operations like unlink wait for checkpoint completion while holding locks that other tasks need. Fix by checking f2fs_cp_error() after processing each inode in f2fs_sync_inode_meta() to detect errors from f2fs_update_inode_page(). Reported-by: syzbot+4235e4d7b6fd75704528@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528 Signed-off-by: Deepanshu Kartikey --- fs/f2fs/inode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index f1cda1900658..7cd0ac088f68 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -763,6 +763,8 @@ void f2fs_update_inode_page(struct inode *inode) struct folio *node_folio; int count = 0; retry: + if (unlikely(f2fs_cp_error(sbi))) + return ; node_folio = f2fs_get_inode_folio(sbi, inode->i_ino); if (IS_ERR(node_folio)) { int err = PTR_ERR(node_folio); -- 2.43.0