* [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup
@ 2026-06-16 13:56 Wenjie Qi
2026-06-17 18:09 ` [f2fs-dev] " Jaegeuk Kim
0 siblings, 1 reply; 5+ messages in thread
From: Wenjie Qi @ 2026-06-16 13:56 UTC (permalink / raw)
To: jaegeuk, chao
Cc: yangyongpeng, geoo115, stable, linux-f2fs-devel, linux-kernel,
qiwenjie, qwjhust
f2fs_write_end_io() decrements the writeback page counter and then
reads it again with get_pages() to decide whether the last
F2FS_WB_CP_DATA completion should wake cp_wait.
Use atomic_dec_return() for F2FS_WB_CP_DATA completions so the wakeup
decision is made from the value produced by the decrement itself. Keep
the existing dec_page_count() path for other writeback counters.
Fixes: e234088758fc ("f2fs: avoid wait if IO end up when do_checkpoint for better performance")
Fixes: ce2739e482bc ("f2fs: fix to avoid UAF in f2fs_write_end_io()")
Cc: stable@vger.kernel.org
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
---
fs/f2fs/data.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index d83a21998ec2..58d23eb74ec2 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -392,15 +392,17 @@ static void f2fs_write_end_io(struct bio *bio)
if (f2fs_in_warm_node_list(folio))
f2fs_del_fsync_node_entry(sbi, folio);
- dec_page_count(sbi, type);
-
/*
* we should access sbi before folio_end_writeback() to
* avoid racing w/ kill_f2fs_super()
*/
- if (type == F2FS_WB_CP_DATA && !get_pages(sbi, type) &&
- wq_has_sleeper(&sbi->cp_wait))
- wake_up(&sbi->cp_wait);
+ if (type == F2FS_WB_CP_DATA) {
+ if (!atomic_dec_return(&sbi->nr_pages[type]) &&
+ wq_has_sleeper(&sbi->cp_wait))
+ wake_up(&sbi->cp_wait);
+ } else {
+ dec_page_count(sbi, type);
+ }
folio_clear_f2fs_gcing(folio);
folio_end_writeback(folio);
base-commit: c0b65f6129c7fbb526e921dd60261650f1b2bef9
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [f2fs-dev] [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup
2026-06-16 13:56 [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup Wenjie Qi
@ 2026-06-17 18:09 ` Jaegeuk Kim
2026-06-18 3:38 ` Wenjie Qi
0 siblings, 1 reply; 5+ messages in thread
From: Jaegeuk Kim @ 2026-06-17 18:09 UTC (permalink / raw)
To: Wenjie Qi
Cc: chao, geoo115, yangyongpeng, linux-kernel, stable,
linux-f2fs-devel, qiwenjie
On 06/16, Wenjie Qi wrote:
> f2fs_write_end_io() decrements the writeback page counter and then
> reads it again with get_pages() to decide whether the last
> F2FS_WB_CP_DATA completion should wake cp_wait.
>
> Use atomic_dec_return() for F2FS_WB_CP_DATA completions so the wakeup
> decision is made from the value produced by the decrement itself. Keep
> the existing dec_page_count() path for other writeback counters.
Is there a race condition to do this? If so, can you describe? And, I think
we need a wrapper function instead of calling nr_pages directly.
>
> Fixes: e234088758fc ("f2fs: avoid wait if IO end up when do_checkpoint for better performance")
> Fixes: ce2739e482bc ("f2fs: fix to avoid UAF in f2fs_write_end_io()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
> ---
> fs/f2fs/data.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
> index d83a21998ec2..58d23eb74ec2 100644
> --- a/fs/f2fs/data.c
> +++ b/fs/f2fs/data.c
> @@ -392,15 +392,17 @@ static void f2fs_write_end_io(struct bio *bio)
> if (f2fs_in_warm_node_list(folio))
> f2fs_del_fsync_node_entry(sbi, folio);
>
> - dec_page_count(sbi, type);
> -
> /*
> * we should access sbi before folio_end_writeback() to
> * avoid racing w/ kill_f2fs_super()
> */
> - if (type == F2FS_WB_CP_DATA && !get_pages(sbi, type) &&
> - wq_has_sleeper(&sbi->cp_wait))
> - wake_up(&sbi->cp_wait);
> + if (type == F2FS_WB_CP_DATA) {
> + if (!atomic_dec_return(&sbi->nr_pages[type]) &&
> + wq_has_sleeper(&sbi->cp_wait))
> + wake_up(&sbi->cp_wait);
> + } else {
> + dec_page_count(sbi, type);
> + }
>
> folio_clear_f2fs_gcing(folio);
> folio_end_writeback(folio);
>
> base-commit: c0b65f6129c7fbb526e921dd60261650f1b2bef9
> --
> 2.43.0
>
>
>
> _______________________________________________
> Linux-f2fs-devel mailing list
> Linux-f2fs-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [f2fs-dev] [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup
2026-06-17 18:09 ` [f2fs-dev] " Jaegeuk Kim
@ 2026-06-18 3:38 ` Wenjie Qi
2026-06-18 9:10 ` Chao Yu
0 siblings, 1 reply; 5+ messages in thread
From: Wenjie Qi @ 2026-06-18 3:38 UTC (permalink / raw)
To: Jaegeuk Kim
Cc: chao, geoo115, yangyongpeng, linux-kernel, stable,
linux-f2fs-devel, qiwenjie
The race is between dec_page_count() and the later get_pages() check:
another CP-data writeback can be submitted after the counter reaches zero
but before get_pages() observes it, so the zero transition may miss the
cp_wait wakeup.
v6 also adds dec_page_count_return() and uses it instead of accessing
nr_pages directly. The wakeup logic is unchanged from v5.
https://lore.kernel.org/linux-f2fs-devel/20260618031008.2447279-1-qiwenjie@xiaomi.com/T/#u
On Thu, Jun 18, 2026 at 2:09 AM Jaegeuk Kim <jaegeuk@kernel.org> wrote:
>
> On 06/16, Wenjie Qi wrote:
> > f2fs_write_end_io() decrements the writeback page counter and then
> > reads it again with get_pages() to decide whether the last
> > F2FS_WB_CP_DATA completion should wake cp_wait.
> >
> > Use atomic_dec_return() for F2FS_WB_CP_DATA completions so the wakeup
> > decision is made from the value produced by the decrement itself. Keep
> > the existing dec_page_count() path for other writeback counters.
>
> Is there a race condition to do this? If so, can you describe? And, I think
> we need a wrapper function instead of calling nr_pages directly.
>
> >
> > Fixes: e234088758fc ("f2fs: avoid wait if IO end up when do_checkpoint for better performance")
> > Fixes: ce2739e482bc ("f2fs: fix to avoid UAF in f2fs_write_end_io()")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
> > ---
> > fs/f2fs/data.c | 12 +++++++-----
> > 1 file changed, 7 insertions(+), 5 deletions(-)
> >
> > diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
> > index d83a21998ec2..58d23eb74ec2 100644
> > --- a/fs/f2fs/data.c
> > +++ b/fs/f2fs/data.c
> > @@ -392,15 +392,17 @@ static void f2fs_write_end_io(struct bio *bio)
> > if (f2fs_in_warm_node_list(folio))
> > f2fs_del_fsync_node_entry(sbi, folio);
> >
> > - dec_page_count(sbi, type);
> > -
> > /*
> > * we should access sbi before folio_end_writeback() to
> > * avoid racing w/ kill_f2fs_super()
> > */
> > - if (type == F2FS_WB_CP_DATA && !get_pages(sbi, type) &&
> > - wq_has_sleeper(&sbi->cp_wait))
> > - wake_up(&sbi->cp_wait);
> > + if (type == F2FS_WB_CP_DATA) {
> > + if (!atomic_dec_return(&sbi->nr_pages[type]) &&
> > + wq_has_sleeper(&sbi->cp_wait))
> > + wake_up(&sbi->cp_wait);
> > + } else {
> > + dec_page_count(sbi, type);
> > + }
> >
> > folio_clear_f2fs_gcing(folio);
> > folio_end_writeback(folio);
> >
> > base-commit: c0b65f6129c7fbb526e921dd60261650f1b2bef9
> > --
> > 2.43.0
> >
> >
> >
> > _______________________________________________
> > Linux-f2fs-devel mailing list
> > Linux-f2fs-devel@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [f2fs-dev] [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup
2026-06-18 3:38 ` Wenjie Qi
@ 2026-06-18 9:10 ` Chao Yu
2026-06-18 10:06 ` Wenjie Qi
0 siblings, 1 reply; 5+ messages in thread
From: Chao Yu @ 2026-06-18 9:10 UTC (permalink / raw)
To: Wenjie Qi, Jaegeuk Kim
Cc: chao, geoo115, yangyongpeng, linux-kernel, stable,
linux-f2fs-devel, qiwenjie
On 6/18/26 11:38, Wenjie Qi wrote:
> The race is between dec_page_count() and the later get_pages() check:
> another CP-data writeback can be submitted after the counter reaches zero
> but before get_pages() observes it, so the zero transition may miss the
> cp_wait wakeup.
Can you describe race condition like below calltrace? which will be easier to
understand?
loop device umount
- worker_thread
- loop_process_work
- do_req_filebacked
- lo_rw_aio
- lo_rw_aio_complete
- blk_mq_end_request
- blk_update_request
- f2fs_write_end_io
- dec_page_count
- folio_end_writeback
- kill_f2fs_super
- kill_block_super
- f2fs_put_super
: free(sbi)
: get_pages(, F2FS_WB_CP_DATA)
accessed sbi which is freed
Thanks,
>
> v6 also adds dec_page_count_return() and uses it instead of accessing
> nr_pages directly. The wakeup logic is unchanged from v5.
>
> https://lore.kernel.org/linux-f2fs-devel/20260618031008.2447279-1-qiwenjie@xiaomi.com/T/#u
>
> On Thu, Jun 18, 2026 at 2:09 AM Jaegeuk Kim <jaegeuk@kernel.org> wrote:
>>
>> On 06/16, Wenjie Qi wrote:
>>> f2fs_write_end_io() decrements the writeback page counter and then
>>> reads it again with get_pages() to decide whether the last
>>> F2FS_WB_CP_DATA completion should wake cp_wait.
>>>
>>> Use atomic_dec_return() for F2FS_WB_CP_DATA completions so the wakeup
>>> decision is made from the value produced by the decrement itself. Keep
>>> the existing dec_page_count() path for other writeback counters.
>>
>> Is there a race condition to do this? If so, can you describe? And, I think
>> we need a wrapper function instead of calling nr_pages directly.
>>
>>>
>>> Fixes: e234088758fc ("f2fs: avoid wait if IO end up when do_checkpoint for better performance")
>>> Fixes: ce2739e482bc ("f2fs: fix to avoid UAF in f2fs_write_end_io()")
>>> Cc: stable@vger.kernel.org
>>> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
>>> ---
>>> fs/f2fs/data.c | 12 +++++++-----
>>> 1 file changed, 7 insertions(+), 5 deletions(-)
>>>
>>> diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
>>> index d83a21998ec2..58d23eb74ec2 100644
>>> --- a/fs/f2fs/data.c
>>> +++ b/fs/f2fs/data.c
>>> @@ -392,15 +392,17 @@ static void f2fs_write_end_io(struct bio *bio)
>>> if (f2fs_in_warm_node_list(folio))
>>> f2fs_del_fsync_node_entry(sbi, folio);
>>>
>>> - dec_page_count(sbi, type);
>>> -
>>> /*
>>> * we should access sbi before folio_end_writeback() to
>>> * avoid racing w/ kill_f2fs_super()
>>> */
>>> - if (type == F2FS_WB_CP_DATA && !get_pages(sbi, type) &&
>>> - wq_has_sleeper(&sbi->cp_wait))
>>> - wake_up(&sbi->cp_wait);
>>> + if (type == F2FS_WB_CP_DATA) {
>>> + if (!atomic_dec_return(&sbi->nr_pages[type]) &&
>>> + wq_has_sleeper(&sbi->cp_wait))
>>> + wake_up(&sbi->cp_wait);
>>> + } else {
>>> + dec_page_count(sbi, type);
>>> + }
>>>
>>> folio_clear_f2fs_gcing(folio);
>>> folio_end_writeback(folio);
>>>
>>> base-commit: c0b65f6129c7fbb526e921dd60261650f1b2bef9
>>> --
>>> 2.43.0
>>>
>>>
>>>
>>> _______________________________________________
>>> Linux-f2fs-devel mailing list
>>> Linux-f2fs-devel@lists.sourceforge.net
>>> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [f2fs-dev] [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup
2026-06-18 9:10 ` Chao Yu
@ 2026-06-18 10:06 ` Wenjie Qi
0 siblings, 0 replies; 5+ messages in thread
From: Wenjie Qi @ 2026-06-18 10:06 UTC (permalink / raw)
To: Chao Yu
Cc: Jaegeuk Kim, geoo115, yangyongpeng, linux-kernel, stable,
linux-f2fs-devel, qiwenjie
Yes. I described the race with a calltrace-style timeline in v7. The
code is
unchanged from v6.
https://lore.kernel.org/linux-f2fs-devel/20260618100503.2601790-1-qiwenjie@xiaomi.com/T/#u
On Thu, Jun 18, 2026 at 5:10 PM Chao Yu <chao@kernel.org> wrote:
>
> On 6/18/26 11:38, Wenjie Qi wrote:
> > The race is between dec_page_count() and the later get_pages() check:
> > another CP-data writeback can be submitted after the counter reaches zero
> > but before get_pages() observes it, so the zero transition may miss the
> > cp_wait wakeup.
>
> Can you describe race condition like below calltrace? which will be easier to
> understand?
>
> loop device umount
> - worker_thread
> - loop_process_work
> - do_req_filebacked
> - lo_rw_aio
> - lo_rw_aio_complete
> - blk_mq_end_request
> - blk_update_request
> - f2fs_write_end_io
> - dec_page_count
> - folio_end_writeback
> - kill_f2fs_super
> - kill_block_super
> - f2fs_put_super
> : free(sbi)
> : get_pages(, F2FS_WB_CP_DATA)
> accessed sbi which is freed
>
> Thanks,
>
> >
> > v6 also adds dec_page_count_return() and uses it instead of accessing
> > nr_pages directly. The wakeup logic is unchanged from v5.
> >
> > https://lore.kernel.org/linux-f2fs-devel/20260618031008.2447279-1-qiwenjie@xiaomi.com/T/#u
> >
> > On Thu, Jun 18, 2026 at 2:09 AM Jaegeuk Kim <jaegeuk@kernel.org> wrote:
> >>
> >> On 06/16, Wenjie Qi wrote:
> >>> f2fs_write_end_io() decrements the writeback page counter and then
> >>> reads it again with get_pages() to decide whether the last
> >>> F2FS_WB_CP_DATA completion should wake cp_wait.
> >>>
> >>> Use atomic_dec_return() for F2FS_WB_CP_DATA completions so the wakeup
> >>> decision is made from the value produced by the decrement itself. Keep
> >>> the existing dec_page_count() path for other writeback counters.
> >>
> >> Is there a race condition to do this? If so, can you describe? And, I think
> >> we need a wrapper function instead of calling nr_pages directly.
> >>
> >>>
> >>> Fixes: e234088758fc ("f2fs: avoid wait if IO end up when do_checkpoint for better performance")
> >>> Fixes: ce2739e482bc ("f2fs: fix to avoid UAF in f2fs_write_end_io()")
> >>> Cc: stable@vger.kernel.org
> >>> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
> >>> ---
> >>> fs/f2fs/data.c | 12 +++++++-----
> >>> 1 file changed, 7 insertions(+), 5 deletions(-)
> >>>
> >>> diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
> >>> index d83a21998ec2..58d23eb74ec2 100644
> >>> --- a/fs/f2fs/data.c
> >>> +++ b/fs/f2fs/data.c
> >>> @@ -392,15 +392,17 @@ static void f2fs_write_end_io(struct bio *bio)
> >>> if (f2fs_in_warm_node_list(folio))
> >>> f2fs_del_fsync_node_entry(sbi, folio);
> >>>
> >>> - dec_page_count(sbi, type);
> >>> -
> >>> /*
> >>> * we should access sbi before folio_end_writeback() to
> >>> * avoid racing w/ kill_f2fs_super()
> >>> */
> >>> - if (type == F2FS_WB_CP_DATA && !get_pages(sbi, type) &&
> >>> - wq_has_sleeper(&sbi->cp_wait))
> >>> - wake_up(&sbi->cp_wait);
> >>> + if (type == F2FS_WB_CP_DATA) {
> >>> + if (!atomic_dec_return(&sbi->nr_pages[type]) &&
> >>> + wq_has_sleeper(&sbi->cp_wait))
> >>> + wake_up(&sbi->cp_wait);
> >>> + } else {
> >>> + dec_page_count(sbi, type);
> >>> + }
> >>>
> >>> folio_clear_f2fs_gcing(folio);
> >>> folio_end_writeback(folio);
> >>>
> >>> base-commit: c0b65f6129c7fbb526e921dd60261650f1b2bef9
> >>> --
> >>> 2.43.0
> >>>
> >>>
> >>>
> >>> _______________________________________________
> >>> Linux-f2fs-devel mailing list
> >>> Linux-f2fs-devel@lists.sourceforge.net
> >>> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-06-18 10:07 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-06-16 13:56 [PATCH v5] f2fs: use post-decrement count for cp_wait wakeup Wenjie Qi
2026-06-17 18:09 ` [f2fs-dev] " Jaegeuk Kim
2026-06-18 3:38 ` Wenjie Qi
2026-06-18 9:10 ` Chao Yu
2026-06-18 10:06 ` Wenjie Qi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox