From nobody Fri Jul 24 21:53:24 2026 Received: from mail-oa1-f45.google.com (mail-oa1-f45.google.com [209.85.160.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 537F23B8407 for ; Fri, 24 Jul 2026 09:05:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784883945; cv=none; b=ObFUp3/r0s/eMPuj4RupqALFb25ERDVsiptezkKrENhE0Km7h8EVJ+bQBVqKklIlqqiyl5gEm0UTHYni6zLOPmAEyHFaOO+yFHClvf4okjlDBFVvW9t9ERG4sjoQGMh8FhXIBOAvQpHiCiKsVVFCCuNdEP0zcssC/mE0d0Bds5Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784883945; c=relaxed/simple; bh=4KF6fBQSdnuzMy7C1JLYq9qu3uwwRNCzvjSZTCuUN3k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sILU16bYd/WTmUB9Q1BMA0QzNNsbftpeA678WIUZaJ8OcuM2bmjGtpeqy+H2jLUIDvODOU3LxcJoZMUpwk677/U5KkYQB3jLb7BgrdmmWFtCr1gqSpAE2e9qMpE1x0mPBg0EYVlCE3mRsud/t/Hc5XZ3SuXneaDP/1cLWTPyXqU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NZ4VVJE5; arc=none smtp.client-ip=209.85.160.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NZ4VVJE5" Received: by mail-oa1-f45.google.com with SMTP id 586e51a60fabf-43bf9548df4so72494fac.0 for ; Fri, 24 Jul 2026 02:05:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784883943; x=1785488743; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=w+dNk6QVT3h2ncm7bXUtKEg64oe4EQaGNEhvbfYPZlM=; b=NZ4VVJE5Ukay8FCcbKcQ3L2w5c8apQw52MfH5mM6cRHLiaOPgVeAFQDEv6JTWRKAWe nZx+C27TZkSjuNgqiyzbSf9tvshsJHxHuiBooqhH3QQGHZjOR/khlJKOtDWihyhPThC0 tnkgQCgYGqHZr5dhICtdU0c2aficWGoPW7DHiDgk5RA5mwInrxYD8u4dNPv/oD4kE5nN 8Lkq9xJ4fLY3rYcfvl4FCXX4kF3ZhsPSsihADf9mRynbew3ihM6wXfQGB09Ap3/0KlZa m4FmSewlU565BvAvMNEz0Mr4en6Z71a249MGJEJ+WqkUOvL1j5sYT7A21KMVKsYs4q6A Q63A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784883943; x=1785488743; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=w+dNk6QVT3h2ncm7bXUtKEg64oe4EQaGNEhvbfYPZlM=; b=TFsi2PW34remnuweEvBZWIg+crFGzn5f5xvGnccf89B9NQfCevJdooyGrgaIlVp3vA +kk40xQFBXcxxwun92LcjG/PBR/TOUmKApby0O9b8AoqWGP9eq1w1WMKtVbK1aDd7u9p XgHYqyRgF0RX0SyAho8GmjBJNx1+6Y2fu/PTyQlC0Ckwn9CfLHAuC4dTBPFFT02tilrV Z7TQqiJUZu2Q/15fSmnCHi+/ePA+7rJ4I6ZYNXMw0/nc6IOui0Te4jOBxxspeYxmm3nh tEmqCaRwumGkV8fhvqSYVqVIfSgTASHZONiNxKD40UEJyPGsA+2EcmOoZRqECvTcMrME DOjg== X-Forwarded-Encrypted: i=1; AHgh+Rp3y8UvXreyF+xrTLU9TnyuisQ3076y9c+D6tf/DcvfCDjBCuvPgnAzyO8RQdBchYYiyVICfma4Qj/E4b0=@vger.kernel.org X-Gm-Message-State: AOJu0YxxYdmHkJG9xQZ5f2c23whQ9aEHUfbAp+110Vw+FoTauzf6ce26 QLuKruOT3oJ/Nbdz4GXHcka1Wcv6zAWzO0jxfTOxFRHtbXHVREmDW4xf X-Gm-Gg: AR+sD10Imle0t2ASOKhhasFjY0oTBaQ+q/8GVYAI32gH5BtSNl54QpvKdrmC3CheTHY QVoTCUMLHytRpm+QuJHRs8sQm2r3vL7E6zeLJijwyTwc3Il1NfcmtD/MSPj5AZ6GtiU2jPTGfgH x47wu81MCsCc1PtB8pWvqPccY341FirdVC0OaJs6w9vfgY3rB57dR+x8F27CVRszeLmaxKMyH5n p5BEeKOrWEz1tSod52AOpDVgECpTlrdeMHjqmR1h7FsbsTyiSHll84TdDMlzxeamDORguPUiRe7 7udNUXDRgqPQZBz9y6X4gakxDslVzD4BAWCi2+Lt6kXz34gvnD9tKlBg8spXSZAM8PVnankiPk6 8HV0pkjxq+1LojZlNt+p7gP9vD4EBcMJFhcJ0xjryq6OyYHiNQ9PkDrDofeaWhdQrn+KHIRBdjO B6Jx3TGd/jOITMLakPMGeGwxR14b0f/Kwrr+0+jw== X-Received: by 2002:a05:6870:51a:b0:43d:1473:b568 with SMTP id 586e51a60fabf-457a0c17d13mr3578698fac.10.1784883943061; Fri, 24 Jul 2026 02:05:43 -0700 (PDT) Received: from qiwenjie-ThinkCentre-M760t.mioffice.cn ([43.224.245.241]) by smtp.gmail.com with ESMTPSA id 586e51a60fabf-45766e7c9d7sm6701436fac.2.2026.07.24.02.05.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 02:05:41 -0700 (PDT) From: Wenjie Qi X-Google-Original-From: Wenjie Qi To: jaegeuk@kernel.org, chao@kernel.org Cc: linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, qiwenjie@xiaomi.com, qwjhust@gmail.com, stable@kernel.org Subject: [PATCH] f2fs: avoid NULL checkpoint thread access in sysfs Date: Fri, 24 Jul 2026 17:05:32 +0800 Message-ID: <20260724090532.351989-1-qiwenjie@xiaomi.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" checkpoint_merge is set by default, but the checkpoint merge thread is not created for read-only mounts. The ckpt_thread_ioprio sysfs store path uses the mount option to decide whether to update the task ioprio. On such mounts, writing the node passes a NULL task to set_task_ioprio(). Keep storing the requested ioprio, but apply it only when the checkpoint thread exists. Take s_umount for ckpt_thread_ioprio and critical_task_priority too, matching the existing protection for GC thread entries. Fixes: e65920661708 ("f2fs: add ckpt_thread_ioprio sysfs node") Cc: stable@kernel.org Signed-off-by: Wenjie Qi --- Reproducer: mount -o ro -t f2fs /dev/vdb /mnt/f2fs echo be,4 > /sys/fs/f2fs/vdb/ckpt_thread_ioprio Baseline dmesg: Oops: general protection fault KASAN: null-ptr-deref in range [0x00000000000007b0-0x00000000000007b7] RIP: set_task_ioprio+0x8b/0x360 Call Trace: f2fs_sbi_store+0x2af/0x2580 kernfs_fop_write_iter+0x360/0x620 vfs_write+0x5f8/0xf50 ksys_write+0xf9/0x1d0 do_syscall_64+0x5f/0x550 fs/f2fs/sysfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c index be92c05a5420..0294544d3d34 100644 --- a/fs/f2fs/sysfs.c +++ b/fs/f2fs/sysfs.c @@ -557,7 +557,7 @@ static ssize_t __sbi_store(struct f2fs_attr *a, return -EINVAL; =20 cprc->ckpt_thread_ioprio =3D IOPRIO_PRIO_VALUE(class, level); - if (test_opt(sbi, MERGE_CHECKPOINT)) { + if (cprc->f2fs_issue_ckpt) { ret =3D set_task_ioprio(cprc->f2fs_issue_ckpt, cprc->ckpt_thread_ioprio); if (ret) @@ -1007,13 +1007,16 @@ static ssize_t f2fs_sbi_store(struct f2fs_attr *a, ssize_t ret; bool gc_entry =3D (!strcmp(a->attr.name, "gc_urgent") || a->struct_type =3D=3D GC_THREAD); + bool thread_entry =3D gc_entry || + !strcmp(a->attr.name, "ckpt_thread_ioprio") || + !strcmp(a->attr.name, "critical_task_priority"); =20 - if (gc_entry) { + if (thread_entry) { if (!down_read_trylock(&sbi->sb->s_umount)) return -EAGAIN; } ret =3D __sbi_store(a, sbi, buf, count); - if (gc_entry) + if (thread_entry) up_read(&sbi->sb->s_umount); =20 return ret; --=20 2.43.0