From nobody Thu Apr 9 23:26:35 2026 Received: from outboundhk.mxmail.xiaomi.com (outboundhk.mxmail.xiaomi.com [207.226.244.123]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 29C2178C9C for ; Thu, 5 Mar 2026 01:18:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=207.226.244.123 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772673503; cv=none; b=DXFFevGSOS2WWM3XD3zauZMpjoMeO4XD0XcgFyBnKY4sIUyOHxdIkrkE9LV5xSDE4R0Z2ZRHfgzDKbdUe08FfAPkxBYmrWUOWTWTTdsAgCT8P4Lg8iZcCnRTvNwgevBIptNC64FXca/3+IyK0/ayGr6NwV3XuSx/y9pqJBKzSto= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772673503; c=relaxed/simple; bh=1dZbH5IPTiIebRhFq9/SfH9frppEUh8VO+L1FyzfceI=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=kgXoWmr6zDK+TW+2vlqfoJtb+1kWypIPLircDjb2rtqHqpO2LGfMhXCvUMyuRMQnEhdGFy5LA4zlDujYP/WZrlHY84pX3imNSN4EpHb/oj/k7dtmVmeikkdSAXvbDsi+5E3Mkx2KASGBtWBwnVlUj5bQsbUqdcPhda96c5gz6a0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=xiaomi.com; spf=pass smtp.mailfrom=xiaomi.com; arc=none smtp.client-ip=207.226.244.123 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=xiaomi.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=xiaomi.com X-CSE-ConnectionGUID: rbaoq5vCTxW5KqH8vHqZAw== X-CSE-MsgGUID: 0W0iOdknS1ukYq2izvlGPA== X-IronPort-AV: E=Sophos;i="6.21,325,1763395200"; d="scan'208";a="168647734" From: Jianan Huang To: , , CC: , , Jianan Huang , Sheng Yong Subject: [PATCH v2] f2fs: avoid reading already updated pages during GC Date: Thu, 5 Mar 2026 09:18:10 +0800 Message-ID: <20260305011810.4189655-1-huangjianan@xiaomi.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BJ-MBX01.mioffice.cn (10.237.8.121) To YZ-MBX05.mioffice.cn (10.237.88.125) Content-Type: text/plain; charset="utf-8" We found the following issue during fuzz testing: page: refcount:3 mapcount:0 mapping:00000000b6e89c65 index:0x18b2dc pfn:0x1= 61ba9 memcg:f8ffff800e269c00 aops:f2fs_meta_aops ino:2 flags: 0x52880000000080a9(locked|waiters|uptodate|lru|private|zone=3D1|kasa= ntag=3D0x4a) raw: 52880000000080a9 fffffffec6e17588 fffffffec0ccc088 a7ffff8067063618 raw: 000000000018b2dc 0000000000000009 00000003ffffffff f8ffff800e269c00 page dumped because: VM_BUG_ON_FOLIO(folio_test_uptodate(folio)) page_owner tracks the page as allocated post_alloc_hook+0x58c/0x5ec prep_new_page+0x34/0x284 get_page_from_freelist+0x2dcc/0x2e8c __alloc_pages_noprof+0x280/0x76c __folio_alloc_noprof+0x18/0xac __filemap_get_folio+0x6bc/0xdc4 pagecache_get_page+0x3c/0x104 do_garbage_collect+0x5c78/0x77a4 f2fs_gc+0xd74/0x25f0 gc_thread_func+0xb28/0x2930 kthread+0x464/0x5d8 ret_from_fork+0x10/0x20 Reviewed-by: Chao Yu ------------[ cut here ]------------ kernel BUG at mm/filemap.c:1563! folio_end_read+0x140/0x168 f2fs_finish_read_bio+0x5c4/0xb80 f2fs_read_end_io+0x64c/0x708 bio_endio+0x85c/0x8c0 blk_update_request+0x690/0x127c scsi_end_request+0x9c/0xb8c scsi_io_completion+0xf0/0x250 scsi_finish_command+0x430/0x45c scsi_complete+0x178/0x6d4 blk_mq_complete_request+0xcc/0x104 scsi_done_internal+0x214/0x454 scsi_done+0x24/0x34 which is similar to the problem reported by syzbot: https://syzkaller.appspot.com/bug?extid=3D3686758660f980b402dc This case is consistent with the description in commit 9bf1a3f ("f2fs: avoid GC causing encrypted file corrupted"): Page 1 is moved from blkaddr A to blkaddr B by move_data_block, and after being written it is marked as uptodate. Then, Page 1 is moved from blkaddr B to blkaddr C, VM_BUG_ON_FOLIO was triggered in the endio initiated by ra_data_block. There is no need to read Page 1 again from blkaddr B, since it has already been updated. Therefore, avoid initiating I/O in this case. Fixes: 6aa58d8ad20a ("f2fs: readahead encrypted block during GC") Signed-off-by: Jianan Huang Signed-off-by: Sheng Yong --- Changes since v1: - Place the uptodate check after the initialization of fio.encrypted_page. fs/f2fs/gc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c index f46b2673d31f..ec0680187c0d 100644 --- a/fs/f2fs/gc.c +++ b/fs/f2fs/gc.c @@ -1230,7 +1230,7 @@ static int ra_data_block(struct inode *inode, pgoff_t= index) .encrypted_page =3D NULL, .in_list =3D 0, }; - int err; + int err =3D 0; =20 folio =3D f2fs_grab_cache_folio(mapping, index, true); if (IS_ERR(folio)) @@ -1283,6 +1283,9 @@ static int ra_data_block(struct inode *inode, pgoff_t= index) =20 fio.encrypted_page =3D &efolio->page; =20 + if (folio_test_uptodate(efolio)) + goto put_encrypted_page; + err =3D f2fs_submit_page_bio(&fio); if (err) goto put_encrypted_page; --=20 2.43.0