From nobody Tue Apr 7 22:01:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4992122A1D4 for ; Wed, 11 Mar 2026 13:35:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773236151; cv=none; b=XexYIchr04CUcWg0DYR5FldJlvFQH0d68p8vyg7HoLrXTRQuFH9vcr/aNmOC4PHymDH8eG+68/JaDQENYLb9ibqQDlaNwutAgH1P5NoDeL6du7Yqg/w7InssTRaueqD3jGdiq4dQbiSjv37XhDMuc9Buv5rlmedRsJLXzH+V8es= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773236151; c=relaxed/simple; bh=B6w+pOLI4c0yj7mh9s6SnyB9dKoUajWjVyf4YAQI7mM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=TzBJDarc8n0XVCjap/0vdTJ5Y9hPj8WlHgUkG8t+kzpULnnvmjsabkpNbKy8cY4JEug9mxyN9G4aWLiYtwpCTnIaJ4+dr6Tcnmv7i3/mR2xf9hLcePtk0vaM/GEnrMl9JSPNUerWZHQJ44DQb2mhs3xruluiDOGarB9xUc/b+Jc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RpX76wfE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RpX76wfE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8038AC4CEF7; Wed, 11 Mar 2026 13:35:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1773236151; bh=B6w+pOLI4c0yj7mh9s6SnyB9dKoUajWjVyf4YAQI7mM=; h=From:To:Cc:Subject:Date:From; b=RpX76wfEcwMcsDM9OR8OP5WRDyQq5f7tccBuDKTvueWQYIrUxum9028wa7FDMBEBW QmqeXX8J+bFmgBNiJA/hxhwKV8fYCc7WemjwYjee35RsU9EWxwP2ohCWUic2dr2+Xl yq/vVNxFhV77nPM0xFmK+PIpsCFrOabtOHHEDdJLfq7AYwbT7lTQ7Qx8+EN7M5q0bT EOlGnAstsNopI/2F85M7+gyo04ZNjJ4jGSLMK5x67Mf2eUS5j0waJmUMx4a3K53WjD Uq6uSmAgePWpjN8IhQjrx9DkH55X19F1nyu9thzjWiXjPDOL5zaVwXUPeZgPBF+O7z My26tIu8KQtDA== From: Chao Yu To: jaegeuk@kernel.org Cc: linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, Chao Yu , stable@kernel.org, syzbot+62538b67389ee582837a@syzkaller.appspotmail.com Subject: [PATCH] f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Date: Wed, 11 Mar 2026 21:35:42 +0800 Message-ID: <20260311133542.1074617-1-chao@kernel.org> X-Mailer: git-send-email 2.53.0.473.g4a7958ca14-goog Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Syzbot reported a f2fs bug as below: Reported-by: syzbot+62538b67389ee582837a@syzkaller.appspotmail.com ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:1900! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6527 Comm: syz.5.110 Not tainted syzkaller #0 PREEMPT_{R= T,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 02/12/2026 RIP: 0010:f2fs_issue_discard_timeout+0x59b/0x5a0 fs/f2fs/segment.c:1900 Code: d9 80 e1 07 80 c1 03 38 c1 0f 8c d6 fe ff ff 48 89 df e8 a8 5e fa fd = e9 c9 fe ff ff e8 4e 46 94 fd 90 0f 0b e8 46 46 94 fd 90 <0f> 0b 0f 1f 00 9= 0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc9000494f940 EFLAGS: 00010283 RAX: ffffffff843009ca RBX: 0000000000000001 RCX: 0000000000080000 RDX: ffffc9001ca78000 RSI: 00000000000029f3 RDI: 00000000000029f4 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed100893a431 R12: 1ffff1100893a430 R13: 1ffff1100c2b702c R14: dffffc0000000000 R15: ffff8880449d2160 FS: 00007ffa35fed6c0(0000) GS:ffff88812643d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2b68634000 CR3: 0000000039f62000 CR4: 00000000003526f0 Call Trace: __f2fs_remount fs/f2fs/super.c:2960 [inline] f2fs_reconfigure+0x108a/0x1710 fs/f2fs/super.c:5443 reconfigure_super+0x227/0x8a0 fs/super.c:1080 do_remount fs/namespace.c:3391 [inline] path_mount+0xdc5/0x10e0 fs/namespace.c:4151 do_mount fs/namespace.c:4172 [inline] __do_sys_mount fs/namespace.c:4361 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4338 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffa37dbda0a The root cause is there will be race condition in between f2fs_ioc_fitrim() and f2fs_remount(): - f2fs_remount - f2fs_ioc_fitrim - f2fs_issue_discard_timeout - __issue_discard_cmd - __drop_discard_cmd - __wait_all_discard_cmd - f2fs_trim_fs - f2fs_write_checkpoint - f2fs_clear_prefree_segments - f2fs_issue_discard - __issue_discard_async - __queue_discard_cmd - __update_discard_tree_range - __insert_discard_cmd - __create_discard_cmd : atomic_inc(&dcc->discard_cmd_cnt); - sanity check on dcc->discard_cmd_cnt (expect discard_cmd_cnt to be zero) This will only happen when fitrim races w/ remount rw, if we remount to readonly filesystem, remount will wait until mnt_pcp.mnt_writers to zero, that means fitrim is not in process at that time. Cc: stable@kernel.org Fixes: 2482c4325dfe ("f2fs: detect bug_on in f2fs_wait_discard_bios") Reported-by: syzbot+62538b67389ee582837a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/69b07d7c.050a0220.8df7.09a= 1.GAE@google.com Signed-off-by: Chao Yu --- fs/f2fs/f2fs.h | 2 +- fs/f2fs/segment.c | 6 +++--- fs/f2fs/super.c | 11 ++++++++--- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index 8942b2a63cfd..e1c2d82ea64e 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -3989,7 +3989,7 @@ bool f2fs_is_checkpointed_data(struct f2fs_sb_info *s= bi, block_t blkaddr); int f2fs_start_discard_thread(struct f2fs_sb_info *sbi); void f2fs_drop_discard_cmd(struct f2fs_sb_info *sbi); void f2fs_stop_discard_thread(struct f2fs_sb_info *sbi); -bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi); +bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi, bool need_check); void f2fs_clear_prefree_segments(struct f2fs_sb_info *sbi, struct cp_control *cpc); void f2fs_dirty_to_prefree(struct f2fs_sb_info *sbi); diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c index 23faf6725632..0bf25786667f 100644 --- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -1880,7 +1880,7 @@ void f2fs_stop_discard_thread(struct f2fs_sb_info *sb= i) * * Return true if issued all discard cmd or no discard cmd need issue, oth= erwise return false. */ -bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi) +bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi, bool need_check) { struct discard_cmd_control *dcc =3D SM_I(sbi)->dcc_info; struct discard_policy dpolicy; @@ -1897,7 +1897,7 @@ bool f2fs_issue_discard_timeout(struct f2fs_sb_info *= sbi) /* just to make sure there is no pending discard commands */ __wait_all_discard_cmd(sbi, NULL); =20 - f2fs_bug_on(sbi, atomic_read(&dcc->discard_cmd_cnt)); + f2fs_bug_on(sbi, need_check && atomic_read(&dcc->discard_cmd_cnt)); return !dropped; } =20 @@ -2367,7 +2367,7 @@ static void destroy_discard_cmd_control(struct f2fs_s= b_info *sbi) * Recovery can cache discard commands, so in error path of * fill_super(), it needs to give a chance to handle them. */ - f2fs_issue_discard_timeout(sbi); + f2fs_issue_discard_timeout(sbi, true); =20 kfree(dcc); SM_I(sbi)->dcc_info =3D NULL; diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 8774c60b4be4..40079fd7886b 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -2009,7 +2009,7 @@ static void f2fs_put_super(struct super_block *sb) } =20 /* be sure to wait for any on-going discard commands */ - done =3D f2fs_issue_discard_timeout(sbi); + done =3D f2fs_issue_discard_timeout(sbi, true); if (f2fs_realtime_discard_enable(sbi) && !sbi->discard_blks && done) { struct cp_control cpc =3D { .reason =3D CP_UMOUNT | CP_TRIMMED, @@ -2152,7 +2152,7 @@ static int f2fs_unfreeze(struct super_block *sb) * will recover after removal of snapshot. */ if (test_opt(sbi, DISCARD) && !f2fs_hw_support_discard(sbi)) - f2fs_issue_discard_timeout(sbi); + f2fs_issue_discard_timeout(sbi, true); =20 clear_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING); return 0; @@ -2957,7 +2957,12 @@ static int __f2fs_remount(struct fs_context *fc, str= uct super_block *sb) need_stop_discard =3D true; } else { f2fs_stop_discard_thread(sbi); - f2fs_issue_discard_timeout(sbi); + /* + * f2fs_ioc_fitrim() won't race w/ "remount ro" + * so it's safe to check discard_cmd_cnt in + * f2fs_issue_discard_timeout(). + */ + f2fs_issue_discard_timeout(sbi, flags & SB_RDONLY); need_restart_discard =3D true; } } --=20 2.49.0