Re: [f2fs-dev] [PATCH] f2fs: compress: fix to handle race between truncate and writeback

[Chao Yu <chao@kernel.org>]

On 9/10/26 15:22, Zhiguo Niu wrote:
> Chao Yu via Linux-f2fs-devel <linux-f2fs-devel@lists.sourceforge.net>
> 于2026年9月10日周四 10:24写道：
>>
>> From: Chao Yu <chao@kernel.org>
>>
>> fsstress reports a kernel BUG in f2fs_truncate_partial_cluster():
>>
>> kernel BUG at fs/f2fs/compress.c:1238!
>> RIP: 0010:f2fs_truncate_partial_cluster+0x292/0x2a0
>> Call Trace:
>>   <TASK>
>>   f2fs_truncate+0xf6/0x210
>>   f2fs_setattr+0x6b7/0x770
>>   notify_change+0x33b/0x520
>>   do_truncate+0xc2/0xf0
>>   vfs_truncate+0x153/0x1d0
>>   ksys_truncate+0x78/0xd0
>>   __x64_sys_truncate+0x16/0x20
>>   do_syscall_64+0xbe/0x540
>>
>> The root cause is that Thread A (truncate) and Thread B (background
>> writeback or fsync) can race as follows:
>>
>> Thread A                             Thread B
>> - f2fs_setattr
>>   - f2fs_truncate
>>    - f2fs_truncate_blocks
>>     - f2fs_truncate_partial_cluster
>>      - f2fs_is_compressed_cluster
>>        return 1
>>                                       - f2fs_write_cache_pages
>>                                        - f2fs_write_multi_pages
>>                                         - f2fs_write_raw_pages
>>                                          - f2fs_write_single_data_page
>>                                            dn.data_blkaddr != COMPRESS_ADDR
>>                                            (cluster converted to normal)
>>      - f2fs_prepare_compress_overwrite
>>       - f2fs_is_compressed_cluster
>>         return 0
>>       - return 0
>>      - f2fs_bug_on(sbi, err == 0): BUG!
>>
>> Writeback path does not acquire i_gc_rwsem or filemap_invalidate_lock.
>> When a compressed cluster fails compression during writeback, it is
>> overwritten with raw data blocks. If Thread A checked
>> f2fs_is_compressed_cluster() before the conversion, but calls
>> f2fs_prepare_compress_overwrite() after the conversion,
>> f2fs_prepare_compress_overwrite() returns 0 because the cluster is no
>> longer a compressed cluster.
>>
>> To fix this, remove the f2fs_bug_on() and retry checking the cluster status
>> when f2fs_prepare_compress_overwrite() returns 0, so that it can fall back
>> to f2fs_do_truncate_blocks() to handle it as a normal cluster.
>>
>> Cc: stable@kernel.org
>> Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
>> Signed-off-by: Chao Yu <chao@kernel.org>
>> ---
>>   fs/f2fs/compress.c | 8 ++++----
>>   1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
>> index ce88092d9ce2..e1cc7185428e 100644
>> --- a/fs/f2fs/compress.c
>> +++ b/fs/f2fs/compress.c
>> @@ -1222,6 +1222,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
>>          int i;
>>          int err;
>>
>> +repeat:
>>          err = f2fs_is_compressed_cluster(inode, start_idx);
>>          if (err < 0)
>>                  return err;
>> @@ -1233,11 +1234,10 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
>>          /* truncate compressed cluster */
>>          err = f2fs_prepare_compress_overwrite(inode, &pagep,
>>                                                  start_idx, &fsdata);
>> +       if (err == 0)
>> +               goto repeat;
> Hi Chao,
>   some comments here will be easier to understand？

Zhiguo, add comments in v2, thanks for the review.

Thanks,

> other LGTM
> Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
> thanks!
>>
>> -       /* should not be a normal cluster */
>> -       f2fs_bug_on(F2FS_I_SB(inode), err == 0);
>> -
>> -       if (err <= 0)
>> +       if (err < 0)
>>                  return err;
>>
>>          rpages = fsdata;
>> --
>> 2.49.0
>>
>>
>>
>> _______________________________________________
>> Linux-f2fs-devel mailing list
>> Linux-f2fs-devel@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel