Re: [PATCH] iomap: fix memory corruption when recording errors during writeback

["Darrick J. Wong" <djwong@kernel.org>]

On Thu, Sep 29, 2022 at 10:29:55PM +0100, Matthew Wilcox wrote:
> On Thu, Sep 29, 2022 at 02:27:17PM -0700, Darrick J. Wong wrote:
> > On Thu, Sep 29, 2022 at 08:33:06PM +0100, Matthew Wilcox wrote:
> > > On Thu, Sep 29, 2022 at 11:44:49AM -0700, Darrick J. Wong wrote:
> > > > Fixes: e735c0079465 ("iomap: Convert iomap_add_to_ioend() to take a folio")
> > > > Probably-Fixes: 598ecfbaa742 ("iomap: lift the xfs writeback code to iomap")
> > > 
> > > I think this is a misuse of Fixes.  As I understand it, Fixes: is "Here's
> > > the commit that introduced the bug", not "This is the most recent change
> > > after which this patch will still apply".  e735c0079465 only changed
> > > s/page/folio/ in this line of code, so clearly didn't introduce the bug.
> > > 
> > > Any kernel containing 598ecfbaa742 has this same bug, so that should be
> > > the Fixes: line.  As you say though, 598ecfbaa742 merely moved the code
> > > from xfs_writepage_map().  bfce7d2e2d5e moved it from xfs_do_writepage(),
> > > but 150d5be09ce4 introduced it.  Six years ago!  Good find.  So how about:
> > > 
> > > Fixes: 150d5be09ce4 ("xfs: remove xfs_cancel_ioend")
> > 
> > Sounds fine to me, though if I hear complaints from AUTOSEL about how
> > the patch does not directly apply to old kernels, I'll forward them to
> > you, because that's what I do now to avoid getting even /more/ email.
> 
> Well, autosel is right to complain ... there's a fix which doesn't
> apply magically to every still-supported kernel containing the bug.
> I'm happy to own backporting this one as far as necessary.

Are you sure?  You're volunteering yourself for 7 LTS backports
5.19, 5.15, 5.10, 5.4, 4.19, 4.14, and 4.9.

--D

> > > Also,
> > > 
> > > Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
> > 
> > However, thank you for the quick review. :)
> > 
> > --D
> > 
> > > > Signed-off-by: Darrick J. Wong <djwong@kernel.org>
> > > > ---
> > > >  fs/iomap/buffered-io.c |    2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > 
> > > > diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
> > > > index ca5c62901541..77d59c159248 100644
> > > > --- a/fs/iomap/buffered-io.c
> > > > +++ b/fs/iomap/buffered-io.c
> > > > @@ -1421,7 +1421,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc,
> > > >  	if (!count)
> > > >  		folio_end_writeback(folio);
> > > >  done:
> > > > -	mapping_set_error(folio->mapping, error);
> > > > +	mapping_set_error(inode->i_mapping, error);
> > > >  	return error;
> > > >  }
> > > >