From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 068752F7F0F for ; Mon, 3 Aug 2026 07:53:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785743630; cv=none; b=PaxkaEog8D1EJfHjxb4kk4kos5+f0TrWs5MAVFUcO26CBUpqJWr68A7kAlOv1S5W48OVVILcua6Tl+ok9te9jjfZ3EKmGPcs8P8wGlJ4n1DbVZ19WEf+n4zZtD/VEhrhN0uWkjqnjbvaRKNfE2AR3716cxVUbB9HStOB5GjhaB8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785743630; c=relaxed/simple; bh=ozFhgH0qEjWwjnXK3zOlVgPopaHfZoPuBJSIDmpbCQc=; h=Message-ID:Date:MIME-Version:Cc:Subject:To:References:From: In-Reply-To:Content-Type; b=V9kRnY3MA09Ic1dX13OIS3YPagbOO22ngZHX3y9xUBchUr7Z5BoWzvTvLXLqM06dTjZYid3vQr0PIlyibyxDL7oBPNGbnFM61w/Jz8Bkw7i1gdTCuzqCBCHuCUFvMobijt4Rd6bPRFrJnTr4I4MlmUefnQIYF3ZRLsR2s7i4VM4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ERjb+lao; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ERjb+lao" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 504051F000E9; Mon, 3 Aug 2026 07:53:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785743628; bh=s2kmPaBfw4Q8qnlJbZoUCA5TVNQr1VvZKD7T+D/ZMnQ=; h=Date:Cc:Subject:To:References:From:In-Reply-To; b=ERjb+lao44DX2QBSKo3tlfGIymcpKToyvtzmF53mJg7TByXHqhepvqEHeSTf+9ez/ G3XH5D2sxismuq7b1UQhz3v9LeC+/fPiRBg0Vc8IMlN50v5YjM9CsbMvglKKTuFYqK pgKKnn57at0IKm56TuWCCfMOlGxSaJ0iLZ6HTff8hqrVCbJdR3wPN9/LrH8pi03dkO coP8680TZc+8VtSI4s1Dm1m/hD+ua6oNBnvK4U8sOkvlE8abxVa0+znF/4EttgzLqq fyIZ/0/xhfFUmQEM/IC8rc2IftfxVPLNy9ziOCZluqhngmqoa1Gf0ZyyfBo9cXnoFK X28LwMqaMi3ww== Message-ID: Date: Mon, 3 Aug 2026 15:53:45 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: chao@kernel.org, linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, qiwenjie@xiaomi.com, stable@kernel.org Subject: Re: [PATCH] f2fs: avoid NULL checkpoint thread access in sysfs To: Wenjie Qi , jaegeuk@kernel.org References: <20260724090532.351989-1-qiwenjie@xiaomi.com> Content-Language: en-US From: Chao Yu In-Reply-To: <20260724090532.351989-1-qiwenjie@xiaomi.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 7/24/26 17:05, Wenjie Qi wrote: > checkpoint_merge is set by default, but the checkpoint merge thread is not > created for read-only mounts. The ckpt_thread_ioprio sysfs store path uses > the mount option to decide whether to update the task ioprio. On such > mounts, writing the node passes a NULL task to set_task_ioprio(). > > Keep storing the requested ioprio, but apply it only when the checkpoint > thread exists. Take s_umount for ckpt_thread_ioprio and > critical_task_priority too, matching the existing protection for GC thread > entries. > > Fixes: e65920661708 ("f2fs: add ckpt_thread_ioprio sysfs node") > Cc: stable@kernel.org > Signed-off-by: Wenjie Qi > --- > Reproducer: > mount -o ro -t f2fs /dev/vdb /mnt/f2fs > echo be,4 > /sys/fs/f2fs/vdb/ckpt_thread_ioprio > > Baseline dmesg: > Oops: general protection fault > KASAN: null-ptr-deref in range [0x00000000000007b0-0x00000000000007b7] > RIP: set_task_ioprio+0x8b/0x360 > Call Trace: > f2fs_sbi_store+0x2af/0x2580 > kernfs_fop_write_iter+0x360/0x620 > vfs_write+0x5f8/0xf50 > ksys_write+0xf9/0x1d0 > do_syscall_64+0x5f/0x550 > > fs/f2fs/sysfs.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c > index be92c05a5420..0294544d3d34 100644 > --- a/fs/f2fs/sysfs.c > +++ b/fs/f2fs/sysfs.c > @@ -557,7 +557,7 @@ static ssize_t __sbi_store(struct f2fs_attr *a, > return -EINVAL; > > cprc->ckpt_thread_ioprio = IOPRIO_PRIO_VALUE(class, level); > - if (test_opt(sbi, MERGE_CHECKPOINT)) { > + if (cprc->f2fs_issue_ckpt) { > ret = set_task_ioprio(cprc->f2fs_issue_ckpt, > cprc->ckpt_thread_ioprio); > if (ret) > @@ -1007,13 +1007,16 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a, > ssize_t ret; > bool gc_entry = (!strcmp(a->attr.name, "gc_urgent") || > a->struct_type == GC_THREAD); > + bool thread_entry = gc_entry || > + !strcmp(a->attr.name, "ckpt_thread_ioprio") || > + !strcmp(a->attr.name, "critical_task_priority"); Oh, seems you fixed another race issue in this patch as well? "mount -o remount,ro" vs "echo xx > critical_task_priority" Can you fix this in a separated patch? > > - if (gc_entry) { > + if (thread_entry) { bool thread_entry = !strcmp(a->attr.name, "ckpt_thread_ioprio") || !strcmp(a->attr.name, "critical_task_priority"); if (gc_entry || thread_entry) > if (!down_read_trylock(&sbi->sb->s_umount)) > return -EAGAIN; > } > ret = __sbi_store(a, sbi, buf, count); > - if (gc_entry) > + if (thread_entry) if (gc_entry || thread_entry) Thanks, > up_read(&sbi->sb->s_umount); > > return ret;