Re: [PATCH] f2fs: avoid cp_wait use-after-free in f2fs_write_end_io()

[Wenjie Qi]

  Agreed, v1 can wake cp_wait before nr_pages[F2FS_WB_CP_DATA] reaches
zero, so
  the waiter may recheck the counter, still see a non-zero value, and
sleep until
  DEFAULT_SCHEDULE_TIMEOUT.

  I sent v2 to address this:
  https://lore.kernel.org/r/20260526034439.1017521-1-qiwenjie@xxxxxxxxxx

  In v2, I used atomic_dec_and_lock_irqsave() for the F2FS_WB_CP_DATA zero
  transition and wake waiters while holding cp_wait.lock.
f2fs_wait_on_all_pages()
  also prepares the wait entry and rechecks get_pages() under the same
lock before
  sleeping.

  This should avoid the missed wakeup you pointed out, while also avoiding an
  unprotected post-zero access to sbi->cp_wait in f2fs_write_end_io().