From: Greg Kroah-Hartman Date: Thu, 16 Jul 2026 13:20:58 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=78fbe96cca3fb6726a9f1de15a341bb8692ee9f4;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: revert-f2fs-remove-non-uptodate-folio-from-the-page-cache-in-move_data_block.patch --- diff --git a/queue-6.18/revert-f2fs-remove-non-uptodate-folio-from-the-page-cache-in-move_data_block.patch b/queue-6.18/revert-f2fs-remove-non-uptodate-folio-from-the-page-cache-in-move_data_block.patch new file mode 100644 index 0000000000..0b094b4850 --- /dev/null +++ b/queue-6.18/revert-f2fs-remove-non-uptodate-folio-from-the-page-cache-in-move_data_block.patch @@ -0,0 +1,147 @@ +From ccaba785821970f422c47770331c7e3271763f17 Mon Sep 17 00:00:00 2001 +From: Zhaoyang Huang +Date: Mon, 8 Jun 2026 17:09:39 +0800 +Subject: Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" + +From: Zhaoyang Huang + +commit ccaba785821970f422c47770331c7e3271763f17 upstream. + +This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. + +The kernel panics are keeping to be reported especially when the f2fs +partition get almost full. By investigation, we find that the reason is +one f2fs page got freed to buddy without being deleted from LRU and the +root cause is the race happened in [2] which is enrolled by this commit. + +There are 3 race processes in this scenario, please find below for their +main activities. + +The changed code in move_data_block() lets the GC path evict the tail-end +folio from the page cache through folio_end_dropbehind(). Once +folio_unmap_invalidate() removes the folio from mapping->i_pages, the +page-cache references for all pages in the folio are dropped. The folio +is then kept alive only by temporary external references, which allows a +later split to operate on a folio whose subpages are no longer protected +by page-cache references. + +After the page-cache references are gone, split_folio_to_order() can +split the big folio into individual pages and put the resulting subpages +back on the LRU. For tail pages beyond EOF, split removes them from the +page cache and drops their page-cache references. A tail page can then +remain on the LRU with PG_lru set while holding only the split caller's +temporary reference. When free_folio_and_swap_cache() drops that final +reference, the page enters the final folio_put() release path. + +In parallel, folio_isolate_lru() can observe the same tail page with a +non-zero refcount and PG_lru set. It clears PG_lru before taking its own +reference. If this races with the final folio_put() from the split path, +__folio_put() sees PG_lru already cleared and skips lruvec_del_folio(). +The page is then freed back to the allocator while its lru links are +still present in the LRU list. A later LRU operation on a neighboring +page detects the stale link and reports list corruption. + +[1] +[ 22.486082] list_del corruption. next->prev should be fffffffec10e0ac8, but was dead000000000122. (next=fffffffec10e0a88) +[ 22.486130] ------------[ cut here ]------------ +[ 22.486134] kernel BUG at lib/list_debug.c:67! +[ 22.486141] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP +[ 22.488502] Tainted: [W]=WARN, [O]=OOT_MODULE +[ 22.488506] Hardware name: Spreadtrum UMS9230 1H10 SoC (DT) +[ 22.488511] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 22.488517] pc : __list_del_entry_valid_or_report+0x14c/0x154 +[ 22.488531] lr : __list_del_entry_valid_or_report+0x14c/0x154 +[ 22.488539] sp : ffffffc08006b830 +[ 22.488542] x29: ffffffc08006b868 x28: 0000000000003020 x27: 0000000000000000 +[ 22.488553] x26: 0000000000000000 x25: 0000000000000004 x24: fffffffec10e0ac0 +[ 22.488564] x23: 00000000000000e8 x22: 0000000000000024 x21: dead000000000122 +[ 22.488574] x20: fffffffec10e0a88 x19: fffffffec10e0ac8 x18: ffffffc080061060 +[ 22.488585] x17: 20747562202c3863 x16: 6130653031636566 x15: 0000000000000058 +[ 22.488595] x14: 0000000000000004 x13: ffffff80f91e0000 x12: 0000000000000003 +[ 22.488605] x11: 0000000000000003 x10: 0000000000000001 x9 : ffe85721f0e25f00 +[ 22.488615] x8 : ffe85721f0e25f00 x7 : 0000000000000000 x6 : 6c65645f7473696c +[ 22.488625] x5 : ffffffed39b23026 x4 : 0000000000000000 x3 : 0000000000000010 +[ 22.488636] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000006d +[ 22.488647] Call trace: +[ 22.488651] __list_del_entry_valid_or_report+0x14c/0x154 (P) +[ 22.488661] __folio_put+0x2bc/0x434 +[ 22.488670] folio_put+0x28/0x58 +[ 22.488678] do_garbage_collect+0x1a34/0x2584 +[ 22.488689] f2fs_gc+0x230/0x9b4 +[ 22.488697] f2fs_fallocate+0xb90/0xdf4 +[ 22.488706] vfs_fallocate+0x1b4/0x2bc +[ 22.488716] __arm64_sys_fallocate+0x44/0x78 +[ 22.488725] invoke_syscall+0x58/0xe4 +[ 22.488732] do_el0_svc+0x48/0xdc +[ 22.488739] el0_svc+0x3c/0x98 +[ 22.488747] el0t_64_sync_handler+0x20/0x130 +[ 22.488754] el0t_64_sync+0x1c4/0x1c8 + +[2] +CPU0 (f2fs GC) CPU1 (split_folio_to_order) CPU2 (folio_isolate_lru) + +F: pagecache refs = n +F: extra refs = GC + split +F: PG_lru set +move_data_block() +folio = f2fs_grab_cache_folio(F) +... +__folio_set_dropbehind(F) +folio_unlock(F) +folio_end_dropbehind(F) + folio_unmap_invalidate(F) + __filemap_remove_folio(F) + folio_put_refs(F, n) +folio_put(F) + split_folio_to_order(F) + folio_ref_freeze(F, 1) + ... + lru_add_split_folio(T) + list_add_tail(&T->lru, &F->lru) + folio_set_lru(T) + __filemap_remove_folio(T) + folio_put_refs(T, 1) + /* T refcount == 1, PageLRU set */ + folio_isolate_lru(T) + folio_test_clear_lru(T) + free_folio_and_swap_cache(T) + folio_put(T) + /* refcount: 1 -> 0 */ + __folio_put(T) + __page_cache_release(T) + folio_test_lru(T) == false + /* skip lruvec_del_folio(T) */ + free_frozen_pages(T) + folio_get(T) + lruvec_del_folio(T) +later: + list_del(adjacent->lru) + next == &T->lru + next->prev == LIST_POISON / PCP freelist + BUG + +Cc: stable@vger.kernel.org +Fixes: 9609dd704725 ("f2fs: remove non-uptodate folio from the page cache in move_data_block") +Signed-off-by: Zhaoyang Huang +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/gc.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -1487,11 +1487,7 @@ up_out: + put_out: + f2fs_put_dnode(&dn); + out: +- if (!folio_test_uptodate(folio)) +- __folio_set_dropbehind(folio); +- folio_unlock(folio); +- folio_end_dropbehind(folio); +- folio_put(folio); ++ f2fs_folio_put(folio, true); + out_iput: + if (atomic_inode) + iput(atomic_inode); diff --git a/queue-6.18/series b/queue-6.18/series index ddb9905c4c..4ba9eddacb 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -477,3 +477,4 @@ sched-fair-only-update-stats-for-allowed-cpus-when-looking-for-dst-group.patch usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch +revert-f2fs-remove-non-uptodate-folio-from-the-page-cache-in-move_data_block.patch