From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f70.google.com (mail-oo1-f70.google.com [209.85.161.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 605C9178372 for ; Sat, 6 Dec 2025 08:03:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.70 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765008214; cv=none; b=NOvu6GfCSpxk1Qv46N0/xu/C/8TYYpo7lKdYPtjEj68IvB/Qg+y3WTdh70EN0+HHOodsnDniK2A6ay9iP4E1hnH6qwABdehfFMQpmInferzFfdNR8IE9X5QguZkKThuKTuSHEKoGmQ0bdCZoncrAubE2+rJOdNiTG8YOcQLFR3U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765008214; c=relaxed/simple; bh=kJlWs2G+rH9pAzRUlWCY0p2T7YUEdaX01P8Ban9Mkzg=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=SoP3uZvcfQ9+FNr1vhIF3h6H2dQN4qIb78Ag4h+eAsQ0K2sJapgqiAJnbUYlPpbpQ9M+4DOp8AHYbWoAfnYIqY9k0Q1b8sbQx2LHipJ+Ajt997tsH4p6lRBF3NfmLam07s+TZ/ZpSOz3b5KUPA6obhtjr9ZEWNHh3Ep3MCF9/iI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f70.google.com with SMTP id 006d021491bc7-6574d366132so2013270eaf.0 for ; Sat, 06 Dec 2025 00:03:32 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765008211; x=1765613011; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=MTZlGgaZeZJTBJ3DVotxx5K1j5OvK3MJdimOH/ZFQhs=; b=aFMqv2XneaewzNl76ZS5W/xU7ww8ZSAzJCBq9al2i/l37fR/frFmx4LU4zmGsbFt12 Hp6QMDVqenD5HcUhtSucrwDIkk92wjj8qdkvQG9UghxD4NHYDY3z/pnIyJVExtjTlKGz I5UkIZ5zto3V/CgcjZH91w8Eqbu61fl161zgU5AQ7glppLWxwLiYqe7P9Sg3XGyuxBHg kS5Nuv0EgYQt78D5PcgpTCp8UH5nEHHPUU6mfaDfZVQD+k4AUMcJsFSffb8F+b/v48sg 23uqrPuEmi68mzQ46/LxSKKkuoLfY9dk1tZ/lGlngsXccx89CI85EB7xg1ukoKaljUhM hMew== X-Gm-Message-State: AOJu0YwhiFEG1/w52QTXnK/iL5SD3wlbLwbNwH1nUtyoOypHY+IM9Nti IEfEl4o4xI5O2jnYizavx/Syp2Ae2YqeEXuwZQkzedHKUkPxiRNfR8aLwpHbQ5aCxVrEK9JQDes BINAQw8Zf3Amh5trlwQz5AYIKXRgV1opH6Q9Ndf1j0x5HnoDjSJKil2rsAlg= X-Google-Smtp-Source: AGHT+IH/H8chqbz89DuMw53aGCsSkio1qhzrMYRdUe+xrZNLnMJwcXpD200gHpPfReT8OBp2rc+Fciq30Rf7u5O2PnmeJz3p7qQI Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:220d:b0:659:9a49:8e56 with SMTP id 006d021491bc7-6599a94aef1mr740792eaf.38.1765008211583; Sat, 06 Dec 2025 00:03:31 -0800 (PST) Date: Sat, 06 Dec 2025 00:03:31 -0800 In-Reply-To: <69332cf9.a70a0220.243dc6.0011.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6933e353.a70a0220.38f243.0019.GAE@google.com> Subject: Forwarded: [PATCH] f2fs: fix hung task in block_operations during checkpoint From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] f2fs: fix hung task in block_operations during checkpoint Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master f2fs_sync_inode_meta() can return 0 (success) even when f2fs_update_inode_page() fails and triggers f2fs_stop_checkpoint(). This happens because the error flag check only occurs at the start of each loop iteration, not after f2fs_update_inode_page() returns. When I/O errors occur: 1. f2fs_update_inode_page() retries 8 times then calls f2fs_stop_checkpoint(), which sets CP_ERROR_FLAG 2. f2fs_sync_inode_meta() returns 0 without checking the error flag 3. block_operations() sees success and loops back to retry_flush_quotas 4. Dirty inodes remain on list (sync failed), loop repeats forever 5. Checkpoint never completes, waiters block indefinitely This causes hung tasks when operations like unlink wait for checkpoint completion while holding locks that other tasks need. Fix by checking f2fs_cp_error() after processing each inode in f2fs_sync_inode_meta() to detect errors from f2fs_update_inode_page(). Reported-by: syzbot+4235e4d7b6fd75704528@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528 Signed-off-by: Deepanshu Kartikey --- fs/f2fs/checkpoint.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c index bbe07e3a6c75..b0b5b792e092 100644 --- a/fs/f2fs/checkpoint.c +++ b/fs/f2fs/checkpoint.c @@ -1659,9 +1659,10 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc) return 0; f2fs_warn(sbi, "Start checkpoint disabled!"); } + printk("f2fs_cp: 1 before cp_global_sem\n"); if (cpc->reason != CP_RESIZE) f2fs_down_write(&sbi->cp_global_sem); - + printk("f2fs_cp: 2 after cp_global_sem\n"); stat_cp_time(cpc, CP_TIME_LOCK); if (!is_sbi_flag_set(sbi, SBI_IS_DIRTY) && @@ -1669,16 +1670,18 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc) ((cpc->reason & CP_DISCARD) && !sbi->discard_blks))) goto out; if (unlikely(f2fs_cp_error(sbi))) { + printk("f2fs_cp: 3 cp_error detected early\n"); err = -EIO; goto out; } trace_f2fs_write_checkpoint(sbi->sb, cpc->reason, "start block_ops"); - + printk("f2fs_cp: 4 before block_operations\n"); err = block_operations(sbi); + printk("f2fs_cp: 5 after block_operations err=%d cp_error=%d\n", err, f2fs_cp_error(sbi)); if (err) goto out; - + //printk("f2fs_cp: 6 before do_checkpoint\n"); stat_cp_time(cpc, CP_TIME_OP_LOCK); trace_f2fs_write_checkpoint(sbi->sb, cpc->reason, "finish block_ops"); @@ -1724,8 +1727,10 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc) /* save inmem log status */ f2fs_save_inmem_curseg(sbi); + printk("f2fs_cp: 4 before block_operations\n"); err = do_checkpoint(sbi, cpc); + printk("f2fs_cp: 7 after do_checkpoint err=%d\n", err); if (err) { f2fs_err(sbi, "do_checkpoint failed err:%d, stop checkpoint", err); f2fs_bug_on(sbi, !f2fs_cp_error(sbi)); -- 2.43.0