* FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree
@ 2018-04-22 9:33 gregkh
2018-04-22 9:52 ` Nathan Chancellor
0 siblings, 1 reply; 6+ messages in thread
From: gregkh @ 2018-04-22 9:33 UTC (permalink / raw)
To: mawilcox, akpm, cfries, hannes, jack, mhocko, minchan, stable,
torvalds
Cc: stable
The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From abc1be13fd113ddef5e2d807a466286b864caed3 Mon Sep 17 00:00:00 2001
From: Matthew Wilcox <mawilcox@microsoft.com>
Date: Fri, 20 Apr 2018 14:56:20 -0700
Subject: [PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
f2fs specifies the __GFP_ZERO flag for allocating some of its pages.
Unfortunately, the page cache also uses the mapping's GFP flags for
allocating radix tree nodes. It always masked off the __GFP_HIGHMEM
flag, and masks off __GFP_ZERO in some paths, but not all. That causes
radix tree nodes to be allocated with a NULL list_head, which causes
backtraces like:
__list_del_entry+0x30/0xd0
list_lru_del+0xac/0x1ac
page_cache_tree_insert+0xd8/0x110
The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through
if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the
innermost location, and remove it from earlier in the callchain.
Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org
Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check")
Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
Reported-by: Chris Fries <cfries@google.com>
Debugged-by: Minchan Kim <minchan@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
diff --git a/mm/filemap.c b/mm/filemap.c
index 9276bdb2343c..0604cb02e6f3 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
VM_BUG_ON_PAGE(!PageLocked(new), new);
VM_BUG_ON_PAGE(new->mapping, new);
- error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
+ error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
if (!error) {
struct address_space *mapping = old->mapping;
void (*freepage)(struct page *);
@@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct page *page,
return error;
}
- error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
+ error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
if (error) {
if (!huge)
mem_cgroup_cancel_charge(page, memcg, false);
@@ -1585,8 +1585,7 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
if (fgp_flags & FGP_ACCESSED)
__SetPageReferenced(page);
- err = add_to_page_cache_lru(page, mapping, offset,
- gfp_mask & GFP_RECLAIM_MASK);
+ err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
if (unlikely(err)) {
put_page(page);
page = NULL;
@@ -2387,7 +2386,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
if (!page)
return -ENOMEM;
- ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
+ ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
if (ret == 0)
ret = mapping->a_ops->readpage(file, page);
else if (ret == -EEXIST)
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree
2018-04-22 9:33 FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree gregkh
@ 2018-04-22 9:52 ` Nathan Chancellor
2018-04-22 9:59 ` Greg KH
2018-04-22 13:37 ` Michal Hocko
0 siblings, 2 replies; 6+ messages in thread
From: Nathan Chancellor @ 2018-04-22 9:52 UTC (permalink / raw)
To: gregkh
Cc: mawilcox, akpm, cfries, hannes, jack, mhocko, minchan, stable,
torvalds
On Sun, Apr 22, 2018 at 11:33:42AM +0200, gregkh@linuxfoundation.org wrote:
>
> The patch below does not apply to the 4.4-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
>
> thanks,
>
> greg k-h
>
> ------------------ original commit in Linus's tree ------------------
>
> From abc1be13fd113ddef5e2d807a466286b864caed3 Mon Sep 17 00:00:00 2001
> From: Matthew Wilcox <mawilcox@microsoft.com>
> Date: Fri, 20 Apr 2018 14:56:20 -0700
> Subject: [PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
>
> f2fs specifies the __GFP_ZERO flag for allocating some of its pages.
> Unfortunately, the page cache also uses the mapping's GFP flags for
> allocating radix tree nodes. It always masked off the __GFP_HIGHMEM
> flag, and masks off __GFP_ZERO in some paths, but not all. That causes
> radix tree nodes to be allocated with a NULL list_head, which causes
> backtraces like:
>
> __list_del_entry+0x30/0xd0
> list_lru_del+0xac/0x1ac
> page_cache_tree_insert+0xd8/0x110
>
> The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through
> if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the
> innermost location, and remove it from earlier in the callchain.
>
> Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org
> Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check")
> Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
> Reported-by: Chris Fries <cfries@google.com>
> Debugged-by: Minchan Kim <minchan@kernel.org>
> Acked-by: Johannes Weiner <hannes@cmpxchg.org>
> Acked-by: Michal Hocko <mhocko@suse.com>
> Reviewed-by: Jan Kara <jack@suse.cz>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>
> diff --git a/mm/filemap.c b/mm/filemap.c
> index 9276bdb2343c..0604cb02e6f3 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
> VM_BUG_ON_PAGE(!PageLocked(new), new);
> VM_BUG_ON_PAGE(new->mapping, new);
>
> - error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
> + error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
> if (!error) {
> struct address_space *mapping = old->mapping;
> void (*freepage)(struct page *);
> @@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct page *page,
> return error;
> }
>
> - error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
> + error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
> if (error) {
> if (!huge)
> mem_cgroup_cancel_charge(page, memcg, false);
> @@ -1585,8 +1585,7 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
> if (fgp_flags & FGP_ACCESSED)
> __SetPageReferenced(page);
>
> - err = add_to_page_cache_lru(page, mapping, offset,
> - gfp_mask & GFP_RECLAIM_MASK);
> + err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
> if (unlikely(err)) {
> put_page(page);
> page = NULL;
> @@ -2387,7 +2386,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
> if (!page)
> return -ENOMEM;
>
> - ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
> + ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
> if (ret == 0)
> ret = mapping->a_ops->readpage(file, page);
> else if (ret == -EEXIST)
>
It looks like c20cd45eb017 ("mm: allow GFP_{FS,IO} for page_cache_read
page cache allocation") came in during 4.5 and reorganized a few things
around the last section.
If you pick that commit then this one, it will be clean (just tested on
4.4.128).
Nathan
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree
2018-04-22 9:52 ` Nathan Chancellor
@ 2018-04-22 9:59 ` Greg KH
2018-04-22 10:12 ` Greg KH
2018-04-22 13:37 ` Michal Hocko
1 sibling, 1 reply; 6+ messages in thread
From: Greg KH @ 2018-04-22 9:59 UTC (permalink / raw)
To: Nathan Chancellor
Cc: mawilcox, akpm, cfries, hannes, jack, mhocko, minchan, stable,
torvalds
On Sun, Apr 22, 2018 at 02:52:40AM -0700, Nathan Chancellor wrote:
> On Sun, Apr 22, 2018 at 11:33:42AM +0200, gregkh@linuxfoundation.org wrote:
> >
> > The patch below does not apply to the 4.4-stable tree.
> > If someone wants it applied there, or to any other stable or longterm
> > tree, then please email the backport, including the original git commit
> > id to <stable@vger.kernel.org>.
> >
> > thanks,
> >
> > greg k-h
> >
> > ------------------ original commit in Linus's tree ------------------
> >
> > From abc1be13fd113ddef5e2d807a466286b864caed3 Mon Sep 17 00:00:00 2001
> > From: Matthew Wilcox <mawilcox@microsoft.com>
> > Date: Fri, 20 Apr 2018 14:56:20 -0700
> > Subject: [PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
> >
> > f2fs specifies the __GFP_ZERO flag for allocating some of its pages.
> > Unfortunately, the page cache also uses the mapping's GFP flags for
> > allocating radix tree nodes. It always masked off the __GFP_HIGHMEM
> > flag, and masks off __GFP_ZERO in some paths, but not all. That causes
> > radix tree nodes to be allocated with a NULL list_head, which causes
> > backtraces like:
> >
> > __list_del_entry+0x30/0xd0
> > list_lru_del+0xac/0x1ac
> > page_cache_tree_insert+0xd8/0x110
> >
> > The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through
> > if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the
> > innermost location, and remove it from earlier in the callchain.
> >
> > Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org
> > Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check")
> > Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
> > Reported-by: Chris Fries <cfries@google.com>
> > Debugged-by: Minchan Kim <minchan@kernel.org>
> > Acked-by: Johannes Weiner <hannes@cmpxchg.org>
> > Acked-by: Michal Hocko <mhocko@suse.com>
> > Reviewed-by: Jan Kara <jack@suse.cz>
> > Cc: <stable@vger.kernel.org>
> > Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> >
> > diff --git a/mm/filemap.c b/mm/filemap.c
> > index 9276bdb2343c..0604cb02e6f3 100644
> > --- a/mm/filemap.c
> > +++ b/mm/filemap.c
> > @@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
> > VM_BUG_ON_PAGE(!PageLocked(new), new);
> > VM_BUG_ON_PAGE(new->mapping, new);
> >
> > - error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
> > + error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
> > if (!error) {
> > struct address_space *mapping = old->mapping;
> > void (*freepage)(struct page *);
> > @@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct page *page,
> > return error;
> > }
> >
> > - error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
> > + error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
> > if (error) {
> > if (!huge)
> > mem_cgroup_cancel_charge(page, memcg, false);
> > @@ -1585,8 +1585,7 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
> > if (fgp_flags & FGP_ACCESSED)
> > __SetPageReferenced(page);
> >
> > - err = add_to_page_cache_lru(page, mapping, offset,
> > - gfp_mask & GFP_RECLAIM_MASK);
> > + err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
> > if (unlikely(err)) {
> > put_page(page);
> > page = NULL;
> > @@ -2387,7 +2386,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
> > if (!page)
> > return -ENOMEM;
> >
> > - ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
> > + ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
> > if (ret == 0)
> > ret = mapping->a_ops->readpage(file, page);
> > else if (ret == -EEXIST)
> >
>
> It looks like c20cd45eb017 ("mm: allow GFP_{FS,IO} for page_cache_read
> page cache allocation") came in during 4.5 and reorganized a few things
> around the last section.
>
> If you pick that commit then this one, it will be clean (just tested on
> 4.4.128).
Ah yes, thanks!
Doesn't work for 3.18.y, let me go dig a bit into why that is...
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree
2018-04-22 9:59 ` Greg KH
@ 2018-04-22 10:12 ` Greg KH
2018-04-22 10:21 ` Harsh Shandilya
0 siblings, 1 reply; 6+ messages in thread
From: Greg KH @ 2018-04-22 10:12 UTC (permalink / raw)
To: Nathan Chancellor
Cc: mawilcox, akpm, cfries, hannes, jack, mhocko, minchan, stable,
torvalds
On Sun, Apr 22, 2018 at 11:59:15AM +0200, Greg KH wrote:
> On Sun, Apr 22, 2018 at 02:52:40AM -0700, Nathan Chancellor wrote:
> > On Sun, Apr 22, 2018 at 11:33:42AM +0200, gregkh@linuxfoundation.org wrote:
> > >
> > > The patch below does not apply to the 4.4-stable tree.
> > > If someone wants it applied there, or to any other stable or longterm
> > > tree, then please email the backport, including the original git commit
> > > id to <stable@vger.kernel.org>.
> > >
> > > thanks,
> > >
> > > greg k-h
> > >
> > > ------------------ original commit in Linus's tree ------------------
> > >
> > > From abc1be13fd113ddef5e2d807a466286b864caed3 Mon Sep 17 00:00:00 2001
> > > From: Matthew Wilcox <mawilcox@microsoft.com>
> > > Date: Fri, 20 Apr 2018 14:56:20 -0700
> > > Subject: [PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
> > >
> > > f2fs specifies the __GFP_ZERO flag for allocating some of its pages.
> > > Unfortunately, the page cache also uses the mapping's GFP flags for
> > > allocating radix tree nodes. It always masked off the __GFP_HIGHMEM
> > > flag, and masks off __GFP_ZERO in some paths, but not all. That causes
> > > radix tree nodes to be allocated with a NULL list_head, which causes
> > > backtraces like:
> > >
> > > __list_del_entry+0x30/0xd0
> > > list_lru_del+0xac/0x1ac
> > > page_cache_tree_insert+0xd8/0x110
> > >
> > > The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through
> > > if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the
> > > innermost location, and remove it from earlier in the callchain.
> > >
> > > Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org
> > > Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check")
> > > Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
> > > Reported-by: Chris Fries <cfries@google.com>
> > > Debugged-by: Minchan Kim <minchan@kernel.org>
> > > Acked-by: Johannes Weiner <hannes@cmpxchg.org>
> > > Acked-by: Michal Hocko <mhocko@suse.com>
> > > Reviewed-by: Jan Kara <jack@suse.cz>
> > > Cc: <stable@vger.kernel.org>
> > > Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> > > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> > >
> > > diff --git a/mm/filemap.c b/mm/filemap.c
> > > index 9276bdb2343c..0604cb02e6f3 100644
> > > --- a/mm/filemap.c
> > > +++ b/mm/filemap.c
> > > @@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
> > > VM_BUG_ON_PAGE(!PageLocked(new), new);
> > > VM_BUG_ON_PAGE(new->mapping, new);
> > >
> > > - error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
> > > + error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
> > > if (!error) {
> > > struct address_space *mapping = old->mapping;
> > > void (*freepage)(struct page *);
> > > @@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct page *page,
> > > return error;
> > > }
> > >
> > > - error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
> > > + error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
> > > if (error) {
> > > if (!huge)
> > > mem_cgroup_cancel_charge(page, memcg, false);
> > > @@ -1585,8 +1585,7 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
> > > if (fgp_flags & FGP_ACCESSED)
> > > __SetPageReferenced(page);
> > >
> > > - err = add_to_page_cache_lru(page, mapping, offset,
> > > - gfp_mask & GFP_RECLAIM_MASK);
> > > + err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
> > > if (unlikely(err)) {
> > > put_page(page);
> > > page = NULL;
> > > @@ -2387,7 +2386,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
> > > if (!page)
> > > return -ENOMEM;
> > >
> > > - ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
> > > + ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
> > > if (ret == 0)
> > > ret = mapping->a_ops->readpage(file, page);
> > > else if (ret == -EEXIST)
> > >
> >
> > It looks like c20cd45eb017 ("mm: allow GFP_{FS,IO} for page_cache_read
> > page cache allocation") came in during 4.5 and reorganized a few things
> > around the last section.
> >
> > If you pick that commit then this one, it will be clean (just tested on
> > 4.4.128).
>
> Ah yes, thanks!
>
> Doesn't work for 3.18.y, let me go dig a bit into why that is...
Ick, 3.18.y is a mess in this area, I'll just leave that alone :)
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree
2018-04-22 10:12 ` Greg KH
@ 2018-04-22 10:21 ` Harsh Shandilya
0 siblings, 0 replies; 6+ messages in thread
From: Harsh Shandilya @ 2018-04-22 10:21 UTC (permalink / raw)
To: Greg KH, Nathan Chancellor
Cc: mawilcox, akpm, cfries, hannes, jack, mhocko, minchan, stable,
torvalds
On 22 April 2018 3:42:46 PM IST, Greg KH <gregkh@linuxfoundation.org> wrote:
>On Sun, Apr 22, 2018 at 11:59:15AM +0200, Greg KH wrote:
>> On Sun, Apr 22, 2018 at 02:52:40AM -0700, Nathan Chancellor wrote:
>> > On Sun, Apr 22, 2018 at 11:33:42AM +0200,
>gregkh@linuxfoundation.org wrote:
>> > >
>> > > The patch below does not apply to the 4.4-stable tree.
>> > > If someone wants it applied there, or to any other stable or
>longterm
>> > > tree, then please email the backport, including the original git
>commit
>> > > id to <stable@vger.kernel.org>.
>> > >
>> > > thanks,
>> > >
>> > > greg k-h
>> > >
>> > > ------------------ original commit in Linus's tree
>------------------
>> > >
>> > > From abc1be13fd113ddef5e2d807a466286b864caed3 Mon Sep 17 00:00:00
>2001
>> > > From: Matthew Wilcox <mawilcox@microsoft.com>
>> > > Date: Fri, 20 Apr 2018 14:56:20 -0700
>> > > Subject: [PATCH] mm/filemap.c: fix NULL pointer in
>page_cache_tree_insert()
>> > >
>> > > f2fs specifies the __GFP_ZERO flag for allocating some of its
>pages.
>> > > Unfortunately, the page cache also uses the mapping's GFP flags
>for
>> > > allocating radix tree nodes. It always masked off the
>__GFP_HIGHMEM
>> > > flag, and masks off __GFP_ZERO in some paths, but not all. That
>causes
>> > > radix tree nodes to be allocated with a NULL list_head, which
>causes
>> > > backtraces like:
>> > >
>> > > __list_del_entry+0x30/0xd0
>> > > list_lru_del+0xac/0x1ac
>> > > page_cache_tree_insert+0xd8/0x110
>> > >
>> > > The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak
>through
>> > > if they are ever used. Fix them all by using GFP_RECLAIM_MASK at
>the
>> > > innermost location, and remove it from earlier in the callchain.
>> > >
>> > > Link:
>http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org
>> > > Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in
>check")
>> > > Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
>> > > Reported-by: Chris Fries <cfries@google.com>
>> > > Debugged-by: Minchan Kim <minchan@kernel.org>
>> > > Acked-by: Johannes Weiner <hannes@cmpxchg.org>
>> > > Acked-by: Michal Hocko <mhocko@suse.com>
>> > > Reviewed-by: Jan Kara <jack@suse.cz>
>> > > Cc: <stable@vger.kernel.org>
>> > > Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>> > > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>> > >
>> > > diff --git a/mm/filemap.c b/mm/filemap.c
>> > > index 9276bdb2343c..0604cb02e6f3 100644
>> > > --- a/mm/filemap.c
>> > > +++ b/mm/filemap.c
>> > > @@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old,
>struct page *new, gfp_t gfp_mask)
>> > > VM_BUG_ON_PAGE(!PageLocked(new), new);
>> > > VM_BUG_ON_PAGE(new->mapping, new);
>> > >
>> > > - error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
>> > > + error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
>> > > if (!error) {
>> > > struct address_space *mapping = old->mapping;
>> > > void (*freepage)(struct page *);
>> > > @@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct
>page *page,
>> > > return error;
>> > > }
>> > >
>> > > - error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
>> > > + error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
>> > > if (error) {
>> > > if (!huge)
>> > > mem_cgroup_cancel_charge(page, memcg, false);
>> > > @@ -1585,8 +1585,7 @@ struct page *pagecache_get_page(struct
>address_space *mapping, pgoff_t offset,
>> > > if (fgp_flags & FGP_ACCESSED)
>> > > __SetPageReferenced(page);
>> > >
>> > > - err = add_to_page_cache_lru(page, mapping, offset,
>> > > - gfp_mask & GFP_RECLAIM_MASK);
>> > > + err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
>> > > if (unlikely(err)) {
>> > > put_page(page);
>> > > page = NULL;
>> > > @@ -2387,7 +2386,7 @@ static int page_cache_read(struct file
>*file, pgoff_t offset, gfp_t gfp_mask)
>> > > if (!page)
>> > > return -ENOMEM;
>> > >
>> > > - ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask &
>GFP_KERNEL);
>> > > + ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
>> > > if (ret == 0)
>> > > ret = mapping->a_ops->readpage(file, page);
>> > > else if (ret == -EEXIST)
>> > >
>> >
>> > It looks like c20cd45eb017 ("mm: allow GFP_{FS,IO} for
>page_cache_read
>> > page cache allocation") came in during 4.5 and reorganized a few
>things
>> > around the last section.
>> >
>> > If you pick that commit then this one, it will be clean (just
>tested on
>> > 4.4.128).
>>
>> Ah yes, thanks!
>>
>> Doesn't work for 3.18.y, let me go dig a bit into why that is...
>
>Ick, 3.18.y is a mess in this area, I'll just leave that alone :)
>
>greg k-h
Good ol' 3.18 :p
I'm keeping track of all the patches Nathan has been sending, I'll spin up another series of backports for 3.18.y tonight or tomorrow.
--
Harsh Shandilya, PRJKT Development LLC
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree
2018-04-22 9:52 ` Nathan Chancellor
2018-04-22 9:59 ` Greg KH
@ 2018-04-22 13:37 ` Michal Hocko
1 sibling, 0 replies; 6+ messages in thread
From: Michal Hocko @ 2018-04-22 13:37 UTC (permalink / raw)
To: Nathan Chancellor
Cc: gregkh, mawilcox, akpm, cfries, hannes, jack, minchan, stable,
torvalds
On Sun 22-04-18 02:52:40, Nathan Chancellor wrote:
> On Sun, Apr 22, 2018 at 11:33:42AM +0200, gregkh@linuxfoundation.org wrote:
> >
> > The patch below does not apply to the 4.4-stable tree.
> > If someone wants it applied there, or to any other stable or longterm
> > tree, then please email the backport, including the original git commit
> > id to <stable@vger.kernel.org>.
> >
> > thanks,
> >
> > greg k-h
> >
> > ------------------ original commit in Linus's tree ------------------
> >
> > From abc1be13fd113ddef5e2d807a466286b864caed3 Mon Sep 17 00:00:00 2001
> > From: Matthew Wilcox <mawilcox@microsoft.com>
> > Date: Fri, 20 Apr 2018 14:56:20 -0700
> > Subject: [PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
> >
> > f2fs specifies the __GFP_ZERO flag for allocating some of its pages.
> > Unfortunately, the page cache also uses the mapping's GFP flags for
> > allocating radix tree nodes. It always masked off the __GFP_HIGHMEM
> > flag, and masks off __GFP_ZERO in some paths, but not all. That causes
> > radix tree nodes to be allocated with a NULL list_head, which causes
> > backtraces like:
> >
> > __list_del_entry+0x30/0xd0
> > list_lru_del+0xac/0x1ac
> > page_cache_tree_insert+0xd8/0x110
> >
> > The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through
> > if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the
> > innermost location, and remove it from earlier in the callchain.
> >
> > Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org
> > Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check")
> > Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
> > Reported-by: Chris Fries <cfries@google.com>
> > Debugged-by: Minchan Kim <minchan@kernel.org>
> > Acked-by: Johannes Weiner <hannes@cmpxchg.org>
> > Acked-by: Michal Hocko <mhocko@suse.com>
> > Reviewed-by: Jan Kara <jack@suse.cz>
> > Cc: <stable@vger.kernel.org>
> > Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> >
> > diff --git a/mm/filemap.c b/mm/filemap.c
> > index 9276bdb2343c..0604cb02e6f3 100644
> > --- a/mm/filemap.c
> > +++ b/mm/filemap.c
> > @@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
> > VM_BUG_ON_PAGE(!PageLocked(new), new);
> > VM_BUG_ON_PAGE(new->mapping, new);
> >
> > - error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
> > + error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
> > if (!error) {
> > struct address_space *mapping = old->mapping;
> > void (*freepage)(struct page *);
> > @@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct page *page,
> > return error;
> > }
> >
> > - error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
> > + error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
> > if (error) {
> > if (!huge)
> > mem_cgroup_cancel_charge(page, memcg, false);
> > @@ -1585,8 +1585,7 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
> > if (fgp_flags & FGP_ACCESSED)
> > __SetPageReferenced(page);
> >
> > - err = add_to_page_cache_lru(page, mapping, offset,
> > - gfp_mask & GFP_RECLAIM_MASK);
> > + err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
> > if (unlikely(err)) {
> > put_page(page);
> > page = NULL;
> > @@ -2387,7 +2386,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
> > if (!page)
> > return -ENOMEM;
> >
> > - ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
> > + ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
> > if (ret == 0)
> > ret = mapping->a_ops->readpage(file, page);
> > else if (ret == -EEXIST)
> >
>
> It looks like c20cd45eb017 ("mm: allow GFP_{FS,IO} for page_cache_read
> page cache allocation") came in during 4.5 and reorganized a few things
> around the last section.
right
> If you pick that commit then this one, it will be clean (just tested on
> 4.4.128).
Or simply patch all radix_tree_*preload calls to restrict their gfp mask
to GFP_RECLAIM_MASK. Or even simpler to hook into
__radix_tree_preload...
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2018-04-22 13:38 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-04-22 9:33 FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree gregkh
2018-04-22 9:52 ` Nathan Chancellor
2018-04-22 9:59 ` Greg KH
2018-04-22 10:12 ` Greg KH
2018-04-22 10:21 ` Harsh Shandilya
2018-04-22 13:37 ` Michal Hocko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).