From: Naman Jain <namjain@linux.microsoft.com>
To: Theodore Ts'o <tytso@mit.edu>,
Andreas Dilger <adilger.kernel@dilger.ca>,
Sasha Levin <sashal@kernel.org>,
Matthew Wilcox <willy@infradead.org>
Cc: stable@vger.kernel.org, linux-ext4@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 6.1] ext4: honor NULL returns from __filemap_get_folio()
Date: Mon, 2 Nov 2026 16:33:41 +0000 [thread overview]
Message-ID: <20261102163341.2170232-1-namjain@linux.microsoft.com> (raw)
The bitmap and buddy folio conversions assume that
__filemap_get_folio() returns error pointers. In Linux 6.1, however,
it returns NULL both when a non-creating lookup misses and when folio
creation fails.
A cache miss therefore passes the IS_ERR() check and reaches
folio_test_uptodate(NULL) in ext4_mb_load_buddy_gfp(). Creating-lookup
failures can also dereference NULL in its slow paths and in
ext4_mb_get_buddy_page_lock().
Restore NULL checks at all six lookup sites and return -ENOMEM when a
creating lookup fails. Preserve the folio locking and migration checks
without changing the global filemap API.
Fixes: d34e4fd4e73f ("ext4: convert bd_bitmap_page to bd_bitmap_folio")
Fixes: 862483175d3d ("ext4: convert bd_buddy_page to bd_buddy_folio")
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
---
fs/ext4/mballoc.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index e77d56c533c0b..d0b276ce9401c 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1375,8 +1375,8 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb,
poff = block % blocks_per_page;
folio = __filemap_get_folio(inode->i_mapping, pnum,
FGP_LOCK | FGP_ACCESSED | FGP_CREAT, gfp);
- if (IS_ERR(folio))
- return PTR_ERR(folio);
+ if (!folio)
+ return -ENOMEM;
BUG_ON(folio->mapping != inode->i_mapping);
e4b->bd_bitmap_folio = folio;
e4b->bd_bitmap = folio_address(folio) + (poff * sb->s_blocksize);
@@ -1389,8 +1389,8 @@ static int ext4_mb_get_buddy_page_lock(struct super_block *sb,
/* blocks_per_page == 1, hence we need another page for the buddy */
folio = __filemap_get_folio(inode->i_mapping, block + 1,
FGP_LOCK | FGP_ACCESSED | FGP_CREAT, gfp);
- if (IS_ERR(folio))
- return PTR_ERR(folio);
+ if (!folio)
+ return -ENOMEM;
BUG_ON(folio->mapping != inode->i_mapping);
e4b->bd_buddy_folio = folio;
return 0;
@@ -1533,7 +1533,7 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,
/* Avoid locking the folio in the fast path ... */
folio = __filemap_get_folio(inode->i_mapping, pnum, FGP_ACCESSED, 0);
- if (IS_ERR(folio) || !folio_test_uptodate(folio) || folio_test_locked(folio)) {
+ if (!folio || !folio_test_uptodate(folio) || folio_test_locked(folio)) {
/*
* folio_test_locked is employed to detect ongoing folio
* migrations, since concurrent migrations can lead to
@@ -1543,11 +1543,11 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,
* try to get the folio with lock in both cases to avoid
* concurrency.
*/
- if (!IS_ERR(folio))
+ if (folio)
folio_put(folio);
folio = __filemap_get_folio(inode->i_mapping, pnum,
FGP_LOCK | FGP_ACCESSED | FGP_CREAT, gfp);
- if (!IS_ERR(folio)) {
+ if (folio) {
if (WARN_RATELIMIT(folio->mapping != inode->i_mapping,
"ext4: bitmap's mapping != inode->i_mapping\n")) {
/* should never happen */
@@ -1567,8 +1567,8 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,
folio_unlock(folio);
}
}
- if (IS_ERR(folio)) {
- ret = PTR_ERR(folio);
+ if (!folio) {
+ ret = -ENOMEM;
goto err;
}
if (!folio_test_uptodate(folio)) {
@@ -1585,12 +1585,12 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,
poff = block % blocks_per_page;
folio = __filemap_get_folio(inode->i_mapping, pnum, FGP_ACCESSED, 0);
- if (IS_ERR(folio) || !folio_test_uptodate(folio) || folio_test_locked(folio)) {
- if (!IS_ERR(folio))
+ if (!folio || !folio_test_uptodate(folio) || folio_test_locked(folio)) {
+ if (folio)
folio_put(folio);
folio = __filemap_get_folio(inode->i_mapping, pnum,
FGP_LOCK | FGP_ACCESSED | FGP_CREAT, gfp);
- if (!IS_ERR(folio)) {
+ if (folio) {
if (WARN_RATELIMIT(folio->mapping != inode->i_mapping,
"ext4: buddy bitmap's mapping != inode->i_mapping\n")) {
/* should never happen */
@@ -1609,8 +1609,8 @@ ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,
folio_unlock(folio);
}
}
- if (IS_ERR(folio)) {
- ret = PTR_ERR(folio);
+ if (!folio) {
+ ret = -ENOMEM;
goto err;
}
if (!folio_test_uptodate(folio)) {
--
2.43.0
next reply other threads:[~2026-11-02 16:33 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-02 16:33 Naman Jain [this message]
2026-11-02 16:38 ` [PATCH 6.1] ext4: honor NULL returns from __filemap_get_folio() sashiko-bot
2026-11-02 17:09 ` Matthew Wilcox
2026-11-02 17:24 ` Naman Jain
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261102163341.2170232-1-namjain@linux.microsoft.com \
--to=namjain@linux.microsoft.com \
--cc=adilger.kernel@dilger.ca \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tytso@mit.edu \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox