From: Naman Jain <namjain@linux.microsoft.com>
To: elliotjb@elliotjb.com
Cc: tytso@mit.edu, adilger.kernel@dilger.ca, sashal@kernel.org,
willy@infradead.org, almaz.alexandrovich@paragon-software.com,
gregkh@linuxfoundation.org, jack@suse.cz,
sunyongjian1@huawei.com, tomberek@gmail.com,
stable@vger.kernel.org, regressions@lists.linux.dev,
linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org,
ntfs3@lists.linux.dev
Subject: Re: [PATCH 6.1.y 0/2] Fix NULL folio dereferences from IS_ERR() checks in 6.1.191
Date: Mon, 2 Nov 2026 17:22:43 +0000 [thread overview]
Message-ID: <20261102172243.2183638-1-namjain@linux.microsoft.com> (raw)
In-Reply-To: <20261102-ext4-ntfs3-null-folio-v1-0-4fd91ee23a4a@elliotjb.com>
> Elliot Berman <elliotjb@elliotjb.com>
>
> We hit a kernel oops in 6.1.191 in ext4_mb_regular_allocator(), When
> ext4's s_buddy_cache pages are evicted, the next block allocation
> dereferences a NULL folio.
> The cause is a mismatch in these backports first released in 6.1.191:
> d34e4fd4e73f ("ext4: convert bd_bitmap_page to bd_bitmap_folio")
> 862483175d3d ("ext4: convert bd_buddy_page to bd_buddy_folio")
>
> The ext4 mballoc folio conversions were written for v6.4 and later,
> where __filemap_get_folio() returns ERR_PTR() on failure. 6.1 does
> not have commit 66dabbb65d67 ("mm: return an ERR_PTR from
> __filemap_get_folio") and returns NULL instead. The backports should
> check for NULL and not IS_ERR.
> Since the same mistake could exist elsewhere, I ran a Coccinelle script
> over the tree to flag similar missed backports. Besides ext4, I found
> one more case in ntfs3:
> 95b917a14b15 ("ntfs: Do not overwrite uptodate pages")
>
> That one needs a folio allocation failure while reading a compressed
> file, so it required crafting a fault injection in
> __filemap_add_folio to reproduce. I've fixed this one as well.
I actually sent a similar patch a little later to fix the same issue :)
We can now ignore that. For ntfs3, there is already a patch fixing the
same issue:
https://lore.kernel.org/all/20261029031815.2783998-1-cmllamas@google.com/
For the series:
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Regards,
Naman Jain
next prev parent reply other threads:[~2026-11-02 17:22 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-02 14:37 [PATCH 6.1.y 0/2] Fix NULL folio dereferences from IS_ERR() checks in 6.1.191 Elliot Berman
2026-11-02 14:37 ` [PATCH 6.1.y 1/2] ext4: fix NULL folio dereference in mballoc Elliot Berman
2026-11-02 14:42 ` sashiko-bot
2026-11-02 14:37 ` [PATCH 6.1.y 2/2] bs/ntfs3: fix NULL folio dereference in ntfs_lock_new_page() Elliot Berman
2026-11-02 14:40 ` sashiko-bot
2026-11-02 17:22 ` Naman Jain [this message]
2026-11-03 1:42 ` [PATCH 6.1.y 0/2] Fix NULL folio dereferences from IS_ERR() checks in 6.1.191 Kevin Fernandez
2026-11-04 15:03 ` Sasha Levin
2026-11-03 14:51 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261102172243.2183638-1-namjain@linux.microsoft.com \
--to=namjain@linux.microsoft.com \
--cc=adilger.kernel@dilger.ca \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=elliotjb@elliotjb.com \
--cc=gregkh@linuxfoundation.org \
--cc=jack@suse.cz \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ntfs3@lists.linux.dev \
--cc=regressions@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=sunyongjian1@huawei.com \
--cc=tomberek@gmail.com \
--cc=tytso@mit.edu \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.