From nobody Fri Dec 19 13:26:55 2025 Received: from mail-oo1-f72.google.com (mail-oo1-f72.google.com [209.85.161.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 831F3221DB6 for ; Sat, 6 Dec 2025 01:58:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764986292; cv=none; b=Njul/2IMY8sqpPdRWM+Xe0Cn6FJ6Np6RZp2yKfusWI4TcOaO3bulSHplPhLIIXO5DuQUkjQgT9o+DIuNHwLFLyy7h9dSoI0n1lJUZoPsgjtvwXUIXTulxx8Z5kyemyfUNkbbAtwM6ZvNqwuorocB4TI/3zVHr3+LXSjX38P0YDs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764986292; c=relaxed/simple; bh=phTltiinsX7Cob9YSGNJbOMO9bTJKEU7qcSJjnNZSkk=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=OAcAtiw/BUvUgqvGBqZHrrD2meJVDAbn7WLP9PoQqR0e0KzHyELmE+KHKe7/L7NtmFLAERXgMhoZg3+gIGLzfokCca5AD1Yna8yBQkQYFINNChSUuT3M7KhwLfnQ5PU1KpHfz7ygh8+BGD+E2emrsKCbvJ17+xZF3G3Lm7pP9Yg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f72.google.com with SMTP id 006d021491bc7-656cc4098f3so3209865eaf.2 for ; Fri, 05 Dec 2025 17:58:10 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764986289; x=1765591089; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=0faarr6USPVkNJ+UheD3QfVtJOIpijAaebckku2tDhU=; b=sspHXRjx1qh+F98/i0TZENBbBwRs2lxJt2wzAUXY7LENVQ6Pb5p6NyTqA10BOQ6sEC /BKGWfeoVvN+O0ghdQLCAu8fKY2PaQU57y/Sf/v7bVREWG/j93oriAgNCdfwvaNj7f/Q MC+4umekrJkQ3OOEyZuYajoBNJnRbN+9wvUKEVLc8kfT3SBONuN+Vd5EJyNTcI2QjAr6 gPRyYIsJ3xjYeoqt432/sj3mye552iIocE5WlK2faz85/Kv/I8H4GMqjgORQnAcuxtNv yfud7XsGw96KFPLAc4+zvsLfUx5NWYH3H1FuL3MPRW0jPjKtsWV7ikz3wNcykwMjeeVg Hdjw== X-Gm-Message-State: AOJu0Yy/Fpe84LFSv2/u6UFDrpvQqkXZoinghzXZt3/BDYyXHykZKuPw vuiXD56lopgV3pi+K6kzhLXvkNBv0mjXoK2rVJwBXB3glJ1dyRj7WbnydyKJLLgdny+6oHhKK27 zikrlTb3aR6dpOWLHbp+sxflJjxz0iKaDcFgQeZMclGeZzT43p8aYHoi6FSo= X-Google-Smtp-Source: AGHT+IEt+7Ip51XeOBdW0S8oe4fWIbcu6t3k1WG2qhtrrxcoeCECl/Tkmd41JTHQi9FOiwbOO27hQkMJ9bEJWUgAxgNUvuQNDT+m Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:4de1:b0:659:9a49:9018 with SMTP id 006d021491bc7-6599a987d5emr536889eaf.69.1764986289561; Fri, 05 Dec 2025 17:58:09 -0800 (PST) Date: Fri, 05 Dec 2025 17:58:09 -0800 In-Reply-To: <69332cf9.a70a0220.243dc6.0011.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69338db1.a70a0220.38f243.000f.GAE@google.com> Subject: Forwarded: [PATCH] f2fs: fix hung task in block_operations during checkpoint From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] f2fs: fix hung task in block_operations during checkpoint Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master f2fs_sync_inode_meta() can return 0 (success) even when f2fs_update_inode_page() fails and triggers f2fs_stop_checkpoint(). This happens because the error flag check only occurs at the start of each loop iteration, not after f2fs_update_inode_page() returns. When I/O errors occur: 1. f2fs_update_inode_page() retries 8 times then calls f2fs_stop_checkpoint(), which sets CP_ERROR_FLAG 2. f2fs_sync_inode_meta() returns 0 without checking the error flag 3. block_operations() sees success and loops back to retry_flush_quotas 4. Dirty inodes remain on list (sync failed), loop repeats forever 5. Checkpoint never completes, waiters block indefinitely This causes hung tasks when operations like unlink wait for checkpoint completion while holding locks that other tasks need. Fix by checking f2fs_cp_error() after processing each inode in f2fs_sync_inode_meta() to detect errors from f2fs_update_inode_page(). Reported-by: syzbot+4235e4d7b6fd75704528@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D4235e4d7b6fd75704528 Signed-off-by: Deepanshu Kartikey --- fs/f2fs/checkpoint.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c index bbe07e3a6c75..5376bb10d650 100644 --- a/fs/f2fs/checkpoint.c +++ b/fs/f2fs/checkpoint.c @@ -1155,6 +1155,8 @@ static int f2fs_sync_inode_meta(struct f2fs_sb_info *= sbi) if (is_inode_flag_set(inode, FI_DIRTY_INODE)) f2fs_update_inode_page(inode); iput(inode); + if (unlikely(f2fs_cp_error(sbi))) + return -EIO; } } return 0; --=20 2.43.0