From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:49040 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751095AbeDVJ7U (ORCPT ); Sun, 22 Apr 2018 05:59:20 -0400 Date: Sun, 22 Apr 2018 11:59:15 +0200 From: Greg KH To: Nathan Chancellor Cc: mawilcox@microsoft.com, akpm@linux-foundation.org, cfries@google.com, hannes@cmpxchg.org, jack@suse.cz, mhocko@suse.com, minchan@kernel.org, stable@vger.kernel.org, torvalds@linux-foundation.org Subject: Re: FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree Message-ID: <20180422095915.GA8498@kroah.com> References: <1524389622196173@kroah.com> <20180422095240.GA10860@flashbox> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180422095240.GA10860@flashbox> Sender: stable-owner@vger.kernel.org List-ID: On Sun, Apr 22, 2018 at 02:52:40AM -0700, Nathan Chancellor wrote: > On Sun, Apr 22, 2018 at 11:33:42AM +0200, gregkh@linuxfoundation.org wrote: > > > > The patch below does not apply to the 4.4-stable tree. > > If someone wants it applied there, or to any other stable or longterm > > tree, then please email the backport, including the original git commit > > id to . > > > > thanks, > > > > greg k-h > > > > ------------------ original commit in Linus's tree ------------------ > > > > From abc1be13fd113ddef5e2d807a466286b864caed3 Mon Sep 17 00:00:00 2001 > > From: Matthew Wilcox > > Date: Fri, 20 Apr 2018 14:56:20 -0700 > > Subject: [PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert() > > > > f2fs specifies the __GFP_ZERO flag for allocating some of its pages. > > Unfortunately, the page cache also uses the mapping's GFP flags for > > allocating radix tree nodes. It always masked off the __GFP_HIGHMEM > > flag, and masks off __GFP_ZERO in some paths, but not all. That causes > > radix tree nodes to be allocated with a NULL list_head, which causes > > backtraces like: > > > > __list_del_entry+0x30/0xd0 > > list_lru_del+0xac/0x1ac > > page_cache_tree_insert+0xd8/0x110 > > > > The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through > > if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the > > innermost location, and remove it from earlier in the callchain. > > > > Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org > > Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check") > > Signed-off-by: Matthew Wilcox > > Reported-by: Chris Fries > > Debugged-by: Minchan Kim > > Acked-by: Johannes Weiner > > Acked-by: Michal Hocko > > Reviewed-by: Jan Kara > > Cc: > > Signed-off-by: Andrew Morton > > Signed-off-by: Linus Torvalds > > > > diff --git a/mm/filemap.c b/mm/filemap.c > > index 9276bdb2343c..0604cb02e6f3 100644 > > --- a/mm/filemap.c > > +++ b/mm/filemap.c > > @@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask) > > VM_BUG_ON_PAGE(!PageLocked(new), new); > > VM_BUG_ON_PAGE(new->mapping, new); > > > > - error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM); > > + error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK); > > if (!error) { > > struct address_space *mapping = old->mapping; > > void (*freepage)(struct page *); > > @@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct page *page, > > return error; > > } > > > > - error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM); > > + error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK); > > if (error) { > > if (!huge) > > mem_cgroup_cancel_charge(page, memcg, false); > > @@ -1585,8 +1585,7 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset, > > if (fgp_flags & FGP_ACCESSED) > > __SetPageReferenced(page); > > > > - err = add_to_page_cache_lru(page, mapping, offset, > > - gfp_mask & GFP_RECLAIM_MASK); > > + err = add_to_page_cache_lru(page, mapping, offset, gfp_mask); > > if (unlikely(err)) { > > put_page(page); > > page = NULL; > > @@ -2387,7 +2386,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask) > > if (!page) > > return -ENOMEM; > > > > - ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL); > > + ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask); > > if (ret == 0) > > ret = mapping->a_ops->readpage(file, page); > > else if (ret == -EEXIST) > > > > It looks like c20cd45eb017 ("mm: allow GFP_{FS,IO} for page_cache_read > page cache allocation") came in during 4.5 and reorganized a few things > around the last section. > > If you pick that commit then this one, it will be clean (just tested on > 4.4.128). Ah yes, thanks! Doesn't work for 3.18.y, let me go dig a bit into why that is... greg k-h