)]}'
{
  "commit": "6429f3bf6dc33cba42055260f905559c43976eeb",
  "tree": "8b0edac6ad0c6fcce5a510cd14dea0dbb6106771",
  "parents": [
    "70f20a6897521fbb6b7b040b6681a533bb54fcfa"
  ],
  "author": {
    "name": "Zhaoyang Huang",
    "email": "zhaoyang.huang@unisoc.com",
    "time": "Mon Jul 13 19:19:44 2026 +0800"
  },
  "committer": {
    "name": "Jaegeuk Kim",
    "email": "jaegeuk@kernel.org",
    "time": "Wed Jul 15 18:06:06 2026 +0000"
  },
  "message": "f2fs: fix folio_nr_pages() race after put in large folio invalidate\n\nOur v6.18 based Android system is continuely suffering livelock and bad\npage stat as shown in[1] which related to broken xarray slot status. By\ninvestigating big folio operations within f2fs, we find below races and\nfix it by get the nr_pages before drop the refcount and folio_lock.\n\nf2fs_get_read_data_folio() calls f2fs_folio_put() before\nfolio_nr_pages() when invalidating a large folio from the page cache.\nThat unlocks the folio and drops the caller reference, leaving a window\nwhere a concurrent truncate or folio split can shrink the compound folio\nor free it before the invalidate range is computed. An undersized range\nthen leaves split sub-folios in mapping-\u003ei_pages, which can later\ninteract badly with truncate and reclaim (stale xarray entries and bad\npage state when folio-\u003emapping no longer matches the mapping being\ntruncated).\n\n[1]\nPID: 2594     TASK: ffffff8169b81580  CPU: 7    COMMAND: \"Thread-3\"\n #0 [ffffffc08ef2b8a0] xas_load at ffffffe52d1f42a4\n #1 [ffffffc08ef2b900] find_get_entries at ffffffe52c185798\n #2 [ffffffc08ef2bb60] truncate_inode_pages_range at ffffffe52c19e83c\n #3 [ffffffc08ef2bbc0] truncate_inode_pages_final at ffffffe52c19ec2c\n #4 [ffffffc08ef2bc20] f2fs_evict_inode at ffffffe52c4c8400\n #5 [ffffffc08ef2bcc0] evict at ffffffe52c2de9f4\n #6 [ffffffc08ef2bd00] iput at ffffffe52c2db1b4\n #7 [ffffffc08ef2bd30] dentry_unlink_inode at ffffffe52c2d7204\n #8 [ffffffc08ef2bd50] __dentry_kill at ffffffe52c2d3dcc\n #9 [ffffffc08ef2bd80] dput at ffffffe52c2d3c3c\n #10 [ffffffc08ef2bda0] __fput at ffffffe52c2b0a7c\n #11 [ffffffc08ef2bde0] ____fput at ffffffe52c2b1034\n #12 [ffffffc08ef2bdf0] task_work_run at ffffffe52beea200\n #13 [ffffffc08ef2be20] exit_to_user_mode_loop at ffffffe52bfbc17c\n #14 [ffffffc08ef2be80] el0_svc at ffffffe52d1f8e54\n #15 [ffffffc08ef2beb0] el0t_64_sync_handler at ffffffe52d1f8d10\n\nSigned-off-by: Zhaoyang Huang \u003czhaoyang.huang@unisoc.com\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "62ea74e65db8c61b2d9000ccb6df6cba16e708dc",
      "old_mode": 33188,
      "old_path": "fs/f2fs/data.c",
      "new_id": "042ed8ad9cc3ed1080bf5daa6b63c6c01e520e8e",
      "new_mode": 33188,
      "new_path": "fs/f2fs/data.c"
    }
  ]
}