Re: [PATCH 6.1.y 1/2] ext4: fix NULL folio dereference in mballoc

[sashiko-bot@kernel.org]

> In 6.1, __filemap_get_folio() returns NULL on failure. The backported
> folio conversion of mballoc keeps the original IS_ERR() checks, so they
> are always false here. The fast-path lookup in ext4_mb_load_buddy_gfp()
> has no FGP_CREAT and returns NULL whenever the bitmap or buddy page of
> an initialised group has been evicted from the page cache, e.g. by
> drop_caches or memory pressure. The next block allocation from that
> group then oopses under ext4_mb_regular_allocator().
> 
> $ echo 3 > /proc/sys/vm/drop_caches, in 0.51 seconds)
> $ dd if=/dev/zero of=/mnt/b0 bs=1M count=4 conv=fsync
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> PGD 5f19067 P4D 0
> Oops: 0000 [#1] PREEMPT SMP NOPTI
> CPU: 0 PID: 908 Comm: dd Not tainted 6.1.191 #1-NixOS
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
> [ ... ]
> 
> Fixes: d34e4fd4e73f ("ext4: convert bd_bitmap_page to bd_bitmap_folio")
> Fixes: 862483175d3d ("ext4: convert bd_buddy_page to bd_buddy_folio")
> Reported-by: Tom Bereknyei <tomberek@gmail.com>
> Signed-off-by: Elliot Berman <elliotjb@elliotjb.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261102-ext4-ntfs3-null-folio-v1-0-4fd91ee23a4a@elliotjb.com?part=1