From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: stable@vger.kernel.org, Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [PATCH 4.14 4.19 5.4 5.10 5.15 6.1] nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
Date: Sat, 24 Jun 2023 16:08:59 +0200 [thread overview]
Message-ID: <2023062452-drank-strife-99ad@gregkh> (raw)
In-Reply-To: <20230624041802.4195-1-konishi.ryusuke@gmail.com>
On Sat, Jun 24, 2023 at 01:18:02PM +0900, Ryusuke Konishi wrote:
> commit 782e53d0c14420858dbf0f8f797973c150d3b6d7 upstream.
>
> In a syzbot stress test that deliberately causes file system errors on
> nilfs2 with a corrupted disk image, it has been reported that
> nilfs_clear_dirty_page() called from nilfs_clear_dirty_pages() can cause a
> general protection fault.
>
> In nilfs_clear_dirty_pages(), when looking up dirty pages from the page
> cache and calling nilfs_clear_dirty_page() for each dirty page/folio
> retrieved, the back reference from the argument page to "mapping" may have
> been changed to NULL (and possibly others). It is necessary to check this
> after locking the page/folio.
>
> So, fix this issue by not calling nilfs_clear_dirty_page() on a page/folio
> after locking it in nilfs_clear_dirty_pages() if the back reference
> "mapping" from the page/folio is different from the "mapping" that held
> the page/folio just before.
>
> Link: https://lkml.kernel.org/r/20230612021456.3682-1-konishi.ryusuke@gmail.com
> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
> Reported-by: syzbot+53369d11851d8f26735c@syzkaller.appspotmail.com
> Closes: https://lkml.kernel.org/r/000000000000da4f6b05eb9bf593@google.com
> Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
> ---
> Please apply this patch to the above stable trees instead of the patch
> that could not be applied to them. This patch resolves the conflict
> caused by the recent page to folio conversion applied in
> nilfs_clear_dirty_pages(). The general protection fault reported by
> syzbot reproduces on these stable kernels before the page/folio
> conversion is applied. This fixes it.
>
> With this tweak, this patch is applicable from v3.10 to v6.2. Also,
> this patch has been tested against the -stable trees of each version in
> the subject prefix.
Now queued up, thanks.
greg k-h
prev parent reply other threads:[~2023-06-24 14:09 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-23 9:24 FAILED: patch "[PATCH] nilfs2: prevent general protection fault in" failed to apply to 6.1-stable tree gregkh
2023-06-24 4:18 ` [PATCH 4.14 4.19 5.4 5.10 5.15 6.1] nilfs2: prevent general protection fault in nilfs_clear_dirty_page() Ryusuke Konishi
2023-06-24 14:08 ` Greg Kroah-Hartman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2023062452-drank-strife-99ad@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=konishi.ryusuke@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.