Linux kernel -stable discussions
 help / color / mirror / Atom feed
* "ext4: get rid of ppath in get_ext_path()" 6.6.y backport request
@ 2026-06-24  9:25 Yoann Congal
  2026-06-24  9:38 ` Greg KH
  0 siblings, 1 reply; 4+ messages in thread
From: Yoann Congal @ 2026-06-24  9:25 UTC (permalink / raw)
  To: stable

Hello,

I'd like to request the backport of
6b854d552711 ("ext4: get rid of ppath in get_ext_path()")
on the 6.6.y branch.

Rational:
6.6.130 commit fb138df7d886 ("ext4: get rid of ppath in ext4_ext_insert_extent()")
created a regression in ext4_ext_map_blocks() by changing the path value
under error (NULL -> ERR_PTR). But path is only checked for NULL value
in ext4_free_ext_path (not ERR_PTR).

The check is added in 6b854d552711 ("ext4: get rid of ppath in get_ext_path()"),
hence this backport request.

More details:
This regression was triggered during LTP test on a 6.6.129->6.6.142
upgrade for a Yocto Project stable branch:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/98/builds/3837
-> https://valkyrie.yocto.io/pub/non-release/20260622-121/testresults/qemuarm64-ltp/core-image-sato/qemu_boot_log.20260623002740

[ 6952.500858] Unable to handle kernel paging request at virtual address ffffffffffffffec
[ 6952.503768] Mem abort info:
[ 6952.504431]   ESR = 0x0000000096000005
[ 6952.505333]   EC = 0x25: DABT (current EL), IL = 32 bits
[ 6952.506541]   SET = 0, FnV = 0
[ 6952.507354]   EA = 0, S1PTW = 0
[ 6952.508154]   FSC = 0x05: level 1 translation fault
[ 6952.509208] Data abort info:
[ 6952.509849]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 6952.511175]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 6952.512372]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 6952.513667] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000041250000
[ 6952.514909] [ffffffffffffffec] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[ 6952.516423] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
[ 6952.517503] Modules linked in: x_tables tun loop [last unloaded: ip6_tables]
[ 6952.518691] CPU: 1 PID: 1078 Comm: kworker/u12:1 Tainted: G        W          6.6.142-yocto-standard #1
[ 6952.520269] Hardware name: linux,dummy-virt (DT)
[ 6952.521094] Workqueue: writeback wb_workfn (flush-7:0)
[ 6952.521985] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 6952.523184] pc : ext4_ext_map_blocks+0x260/0x1860
[ 6952.524011] lr : ext4_ext_map_blocks+0xdb8/0x1860
[ 6952.524851] sp : ffffffc086a3b620
[ 6952.525421] x29: ffffffc086a3b740 x28: ffffffffffffffe4 x27: 000000000000808c
[ 6952.526624] x26: ffffff8017dd9000 x25: 000000000000808c x24: 0000000000000002
[ 6952.527849] x23: ffffff8035e766c8 x22: ffffff802e589690 x21: 000000000000042f
[ 6952.529087] x20: ffffffc086a3b948 x19: ffffff8035e767f0 x18: 0000000000000000
[ 6952.530310] x17: ffffffc081691310 x16: fffffffe001ab548 x15: 0000005564d4cb48
[ 6952.531519] x14: 00000000ffffffff x13: 0000000000000000 x12: ffffffffffffffc0
[ 6952.532683] x11: 0000000000000040 x10: ffffff8005d81d80 x9 : ffffffc0803cce14
[ 6952.533886] x8 : 00000000bab647bc x7 : 0000000000000000 x6 : 000000000000d847
[ 6952.535065] x5 : 0000000000000000 x4 : 0000000000316019 x3 : 0000000000000000
[ 6952.536264] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff803deec880
[ 6952.537425] Call trace:
[ 6952.537860]  ext4_ext_map_blocks+0x260/0x1860
[ 6952.538589]  ext4_map_blocks+0x19c/0x598
[ 6952.539258]  ext4_do_writepages+0x5a4/0xbe0
[ 6952.539977]  ext4_writepages+0x84/0x110
[ 6952.540624]  do_writepages+0x94/0x1e0
[ 6952.541240]  __writeback_single_inode+0x60/0x4d8
[ 6952.542086]  writeback_sb_inodes+0x208/0x4b0
[ 6952.542812]  __writeback_inodes_wb+0x58/0x118
[ 6952.543578]  wb_writeback+0x274/0x440
[ 6952.544198]  wb_workfn+0x3b0/0x5c8
[ 6952.544788]  process_one_work+0x16c/0x3e0
[ 6952.545434]  worker_thread+0x1b4/0x378
[ 6952.546059]  kthread+0x118/0x128
[ 6952.546599]  ret_from_fork+0x10/0x20
[ 6952.547197] Code: 2a0103f9 b9009fe1 b9000e99 b40055fc (79401398)
[ 6952.548170] ---[ end trace 0000000000000000 ]---
[ 6952.551090] ------------[ cut here ]------------

Reading the resulting code in 6.6.142:
fs/ext4/extents.c:
int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
			struct ext4_map_blocks *map, int flags)
{
	struct ext4_ext_path *path = NULL;
	// ...

got_allocated_blocks:
	path = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
	if (IS_ERR(path)) {
		err = PTR_ERR(path);
		/*
		 * Gracefully handle out of space conditions. If the filesystem
		 * is inconsistent, we'll just leak allocated blocks to avoid
		 * causing even more damage.
		 */
		// ...
		goto out;
	}

	// ...
out:
	ext4_free_ext_path(path);

	trace_ext4_ext_map_blocks_exit(inode, flags, map,
				       err ? err : allocated);
	return err ? err : allocated;
}

=> Under out of space condition (what LTP does a *LOT*): path is given unmodified to
ext4_free_ext_path() that only does a NULL check (no IS_ERR) before
dereferencing it. And that produces the oops and then, the LTP failure.

Notably, master commit 6b854d552711 ("ext4: get rid of ppath in get_ext_path()")
never got backported to 6.6.y. But does add the IS_ERR_OR_NULL() check
to ext4_free_ext_path:
 void ext4_free_ext_path(struct ext4_ext_path *path)
 {
+       if (IS_ERR_OR_NULL(path))
+               return;

Thanks!
-- 
Yoann Congal
Smile ECS

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: "ext4: get rid of ppath in get_ext_path()" 6.6.y backport request
  2026-06-24  9:25 "ext4: get rid of ppath in get_ext_path()" 6.6.y backport request Yoann Congal
@ 2026-06-24  9:38 ` Greg KH
  2026-06-24  9:44   ` Yoann Congal
  2026-06-29  3:09   ` Jiayuan Chen
  0 siblings, 2 replies; 4+ messages in thread
From: Greg KH @ 2026-06-24  9:38 UTC (permalink / raw)
  To: Yoann Congal; +Cc: stable

On Wed, Jun 24, 2026 at 11:25:06AM +0200, Yoann Congal wrote:
> Hello,
> 
> I'd like to request the backport of
> 6b854d552711 ("ext4: get rid of ppath in get_ext_path()")
> on the 6.6.y branch.
> 
> Rational:
> 6.6.130 commit fb138df7d886 ("ext4: get rid of ppath in ext4_ext_insert_extent()")
> created a regression in ext4_ext_map_blocks() by changing the path value
> under error (NULL -> ERR_PTR). But path is only checked for NULL value
> in ext4_free_ext_path (not ERR_PTR).
> 
> The check is added in 6b854d552711 ("ext4: get rid of ppath in get_ext_path()"),
> hence this backport request.
> 
> More details:
> This regression was triggered during LTP test on a 6.6.129->6.6.142
> upgrade for a Yocto Project stable branch:
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/98/builds/3837
> -> https://valkyrie.yocto.io/pub/non-release/20260622-121/testresults/qemuarm64-ltp/core-image-sato/qemu_boot_log.20260623002740
> 
> [ 6952.500858] Unable to handle kernel paging request at virtual address ffffffffffffffec
> [ 6952.503768] Mem abort info:
> [ 6952.504431]   ESR = 0x0000000096000005
> [ 6952.505333]   EC = 0x25: DABT (current EL), IL = 32 bits
> [ 6952.506541]   SET = 0, FnV = 0
> [ 6952.507354]   EA = 0, S1PTW = 0
> [ 6952.508154]   FSC = 0x05: level 1 translation fault
> [ 6952.509208] Data abort info:
> [ 6952.509849]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
> [ 6952.511175]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> [ 6952.512372]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [ 6952.513667] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000041250000
> [ 6952.514909] [ffffffffffffffec] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
> [ 6952.516423] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
> [ 6952.517503] Modules linked in: x_tables tun loop [last unloaded: ip6_tables]
> [ 6952.518691] CPU: 1 PID: 1078 Comm: kworker/u12:1 Tainted: G        W          6.6.142-yocto-standard #1
> [ 6952.520269] Hardware name: linux,dummy-virt (DT)
> [ 6952.521094] Workqueue: writeback wb_workfn (flush-7:0)
> [ 6952.521985] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 6952.523184] pc : ext4_ext_map_blocks+0x260/0x1860
> [ 6952.524011] lr : ext4_ext_map_blocks+0xdb8/0x1860
> [ 6952.524851] sp : ffffffc086a3b620
> [ 6952.525421] x29: ffffffc086a3b740 x28: ffffffffffffffe4 x27: 000000000000808c
> [ 6952.526624] x26: ffffff8017dd9000 x25: 000000000000808c x24: 0000000000000002
> [ 6952.527849] x23: ffffff8035e766c8 x22: ffffff802e589690 x21: 000000000000042f
> [ 6952.529087] x20: ffffffc086a3b948 x19: ffffff8035e767f0 x18: 0000000000000000
> [ 6952.530310] x17: ffffffc081691310 x16: fffffffe001ab548 x15: 0000005564d4cb48
> [ 6952.531519] x14: 00000000ffffffff x13: 0000000000000000 x12: ffffffffffffffc0
> [ 6952.532683] x11: 0000000000000040 x10: ffffff8005d81d80 x9 : ffffffc0803cce14
> [ 6952.533886] x8 : 00000000bab647bc x7 : 0000000000000000 x6 : 000000000000d847
> [ 6952.535065] x5 : 0000000000000000 x4 : 0000000000316019 x3 : 0000000000000000
> [ 6952.536264] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff803deec880
> [ 6952.537425] Call trace:
> [ 6952.537860]  ext4_ext_map_blocks+0x260/0x1860
> [ 6952.538589]  ext4_map_blocks+0x19c/0x598
> [ 6952.539258]  ext4_do_writepages+0x5a4/0xbe0
> [ 6952.539977]  ext4_writepages+0x84/0x110
> [ 6952.540624]  do_writepages+0x94/0x1e0
> [ 6952.541240]  __writeback_single_inode+0x60/0x4d8
> [ 6952.542086]  writeback_sb_inodes+0x208/0x4b0
> [ 6952.542812]  __writeback_inodes_wb+0x58/0x118
> [ 6952.543578]  wb_writeback+0x274/0x440
> [ 6952.544198]  wb_workfn+0x3b0/0x5c8
> [ 6952.544788]  process_one_work+0x16c/0x3e0
> [ 6952.545434]  worker_thread+0x1b4/0x378
> [ 6952.546059]  kthread+0x118/0x128
> [ 6952.546599]  ret_from_fork+0x10/0x20
> [ 6952.547197] Code: 2a0103f9 b9009fe1 b9000e99 b40055fc (79401398)
> [ 6952.548170] ---[ end trace 0000000000000000 ]---
> [ 6952.551090] ------------[ cut here ]------------
> 
> Reading the resulting code in 6.6.142:
> fs/ext4/extents.c:
> int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
> 			struct ext4_map_blocks *map, int flags)
> {
> 	struct ext4_ext_path *path = NULL;
> 	// ...
> 
> got_allocated_blocks:
> 	path = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
> 	if (IS_ERR(path)) {
> 		err = PTR_ERR(path);
> 		/*
> 		 * Gracefully handle out of space conditions. If the filesystem
> 		 * is inconsistent, we'll just leak allocated blocks to avoid
> 		 * causing even more damage.
> 		 */
> 		// ...
> 		goto out;
> 	}
> 
> 	// ...
> out:
> 	ext4_free_ext_path(path);
> 
> 	trace_ext4_ext_map_blocks_exit(inode, flags, map,
> 				       err ? err : allocated);
> 	return err ? err : allocated;
> }
> 
> => Under out of space condition (what LTP does a *LOT*): path is given unmodified to
> ext4_free_ext_path() that only does a NULL check (no IS_ERR) before
> dereferencing it. And that produces the oops and then, the LTP failure.
> 
> Notably, master commit 6b854d552711 ("ext4: get rid of ppath in get_ext_path()")
> never got backported to 6.6.y. But does add the IS_ERR_OR_NULL() check
> to ext4_free_ext_path:
>  void ext4_free_ext_path(struct ext4_ext_path *path)
>  {
> +       if (IS_ERR_OR_NULL(path))
> +               return;
> 
> Thanks!

Please always cc: the maintainers and developers involved in a patch
when asking for it to be backported, as we need their approval as well
before we can do it.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: "ext4: get rid of ppath in get_ext_path()" 6.6.y backport request
  2026-06-24  9:38 ` Greg KH
@ 2026-06-24  9:44   ` Yoann Congal
  2026-06-29  3:09   ` Jiayuan Chen
  1 sibling, 0 replies; 4+ messages in thread
From: Yoann Congal @ 2026-06-24  9:44 UTC (permalink / raw)
  To: Greg KH; +Cc: stable

On Wed Jun 24, 2026 at 11:38 AM CEST, Greg KH wrote:
> On Wed, Jun 24, 2026 at 11:25:06AM +0200, Yoann Congal wrote:
>> Hello,
>> 
>> I'd like to request the backport of
>> 6b854d552711 ("ext4: get rid of ppath in get_ext_path()")
>> on the 6.6.y branch.
>> 
>> Rational:
>> 6.6.130 commit fb138df7d886 ("ext4: get rid of ppath in ext4_ext_insert_extent()")
>> created a regression in ext4_ext_map_blocks() by changing the path value
>> under error (NULL -> ERR_PTR). But path is only checked for NULL value
>> in ext4_free_ext_path (not ERR_PTR).
>> 
>> The check is added in 6b854d552711 ("ext4: get rid of ppath in get_ext_path()"),
>> hence this backport request.
>> 
>> More details:
>> This regression was triggered during LTP test on a 6.6.129->6.6.142
>> upgrade for a Yocto Project stable branch:
>> https://autobuilder.yoctoproject.org/valkyrie/#/builders/98/builds/3837
>> -> https://valkyrie.yocto.io/pub/non-release/20260622-121/testresults/qemuarm64-ltp/core-image-sato/qemu_boot_log.20260623002740
>> 
>> [ 6952.500858] Unable to handle kernel paging request at virtual address ffffffffffffffec
>> [ 6952.503768] Mem abort info:
>> [ 6952.504431]   ESR = 0x0000000096000005
>> [ 6952.505333]   EC = 0x25: DABT (current EL), IL = 32 bits
>> [ 6952.506541]   SET = 0, FnV = 0
>> [ 6952.507354]   EA = 0, S1PTW = 0
>> [ 6952.508154]   FSC = 0x05: level 1 translation fault
>> [ 6952.509208] Data abort info:
>> [ 6952.509849]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
>> [ 6952.511175]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
>> [ 6952.512372]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
>> [ 6952.513667] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000041250000
>> [ 6952.514909] [ffffffffffffffec] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
>> [ 6952.516423] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
>> [ 6952.517503] Modules linked in: x_tables tun loop [last unloaded: ip6_tables]
>> [ 6952.518691] CPU: 1 PID: 1078 Comm: kworker/u12:1 Tainted: G        W          6.6.142-yocto-standard #1
>> [ 6952.520269] Hardware name: linux,dummy-virt (DT)
>> [ 6952.521094] Workqueue: writeback wb_workfn (flush-7:0)
>> [ 6952.521985] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>> [ 6952.523184] pc : ext4_ext_map_blocks+0x260/0x1860
>> [ 6952.524011] lr : ext4_ext_map_blocks+0xdb8/0x1860
>> [ 6952.524851] sp : ffffffc086a3b620
>> [ 6952.525421] x29: ffffffc086a3b740 x28: ffffffffffffffe4 x27: 000000000000808c
>> [ 6952.526624] x26: ffffff8017dd9000 x25: 000000000000808c x24: 0000000000000002
>> [ 6952.527849] x23: ffffff8035e766c8 x22: ffffff802e589690 x21: 000000000000042f
>> [ 6952.529087] x20: ffffffc086a3b948 x19: ffffff8035e767f0 x18: 0000000000000000
>> [ 6952.530310] x17: ffffffc081691310 x16: fffffffe001ab548 x15: 0000005564d4cb48
>> [ 6952.531519] x14: 00000000ffffffff x13: 0000000000000000 x12: ffffffffffffffc0
>> [ 6952.532683] x11: 0000000000000040 x10: ffffff8005d81d80 x9 : ffffffc0803cce14
>> [ 6952.533886] x8 : 00000000bab647bc x7 : 0000000000000000 x6 : 000000000000d847
>> [ 6952.535065] x5 : 0000000000000000 x4 : 0000000000316019 x3 : 0000000000000000
>> [ 6952.536264] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff803deec880
>> [ 6952.537425] Call trace:
>> [ 6952.537860]  ext4_ext_map_blocks+0x260/0x1860
>> [ 6952.538589]  ext4_map_blocks+0x19c/0x598
>> [ 6952.539258]  ext4_do_writepages+0x5a4/0xbe0
>> [ 6952.539977]  ext4_writepages+0x84/0x110
>> [ 6952.540624]  do_writepages+0x94/0x1e0
>> [ 6952.541240]  __writeback_single_inode+0x60/0x4d8
>> [ 6952.542086]  writeback_sb_inodes+0x208/0x4b0
>> [ 6952.542812]  __writeback_inodes_wb+0x58/0x118
>> [ 6952.543578]  wb_writeback+0x274/0x440
>> [ 6952.544198]  wb_workfn+0x3b0/0x5c8
>> [ 6952.544788]  process_one_work+0x16c/0x3e0
>> [ 6952.545434]  worker_thread+0x1b4/0x378
>> [ 6952.546059]  kthread+0x118/0x128
>> [ 6952.546599]  ret_from_fork+0x10/0x20
>> [ 6952.547197] Code: 2a0103f9 b9009fe1 b9000e99 b40055fc (79401398)
>> [ 6952.548170] ---[ end trace 0000000000000000 ]---
>> [ 6952.551090] ------------[ cut here ]------------
>> 
>> Reading the resulting code in 6.6.142:
>> fs/ext4/extents.c:
>> int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
>> 			struct ext4_map_blocks *map, int flags)
>> {
>> 	struct ext4_ext_path *path = NULL;
>> 	// ...
>> 
>> got_allocated_blocks:
>> 	path = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
>> 	if (IS_ERR(path)) {
>> 		err = PTR_ERR(path);
>> 		/*
>> 		 * Gracefully handle out of space conditions. If the filesystem
>> 		 * is inconsistent, we'll just leak allocated blocks to avoid
>> 		 * causing even more damage.
>> 		 */
>> 		// ...
>> 		goto out;
>> 	}
>> 
>> 	// ...
>> out:
>> 	ext4_free_ext_path(path);
>> 
>> 	trace_ext4_ext_map_blocks_exit(inode, flags, map,
>> 				       err ? err : allocated);
>> 	return err ? err : allocated;
>> }
>> 
>> => Under out of space condition (what LTP does a *LOT*): path is given unmodified to
>> ext4_free_ext_path() that only does a NULL check (no IS_ERR) before
>> dereferencing it. And that produces the oops and then, the LTP failure.
>> 
>> Notably, master commit 6b854d552711 ("ext4: get rid of ppath in get_ext_path()")
>> never got backported to 6.6.y. But does add the IS_ERR_OR_NULL() check
>> to ext4_free_ext_path:
>>  void ext4_free_ext_path(struct ext4_ext_path *path)
>>  {
>> +       if (IS_ERR_OR_NULL(path))
>> +               return;
>> 
>> Thanks!
>
> Please always cc: the maintainers and developers involved in a patch
> when asking for it to be backported, as we need their approval as well
> before we can do it.

Ok, sorry, I'll resend with proper CCs.

Thanks!

>
> thanks,
>
> greg k-h


-- 
Yoann Congal
Smile ECS


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: "ext4: get rid of ppath in get_ext_path()" 6.6.y backport request
  2026-06-24  9:38 ` Greg KH
  2026-06-24  9:44   ` Yoann Congal
@ 2026-06-29  3:09   ` Jiayuan Chen
  1 sibling, 0 replies; 4+ messages in thread
From: Jiayuan Chen @ 2026-06-29  3:09 UTC (permalink / raw)
  To: Greg KH; +Cc: Yoann Congal, stable, tytso

On Wed, Jun 24, 2026 at 11:38:42AM +0800, Greg KH wrote:
> On Wed, Jun 24, 2026 at 11:25:06AM +0200, Yoann Congal wrote:
> > Hello,
> > 
[...]
> > [ 6952.547197] Code: 2a0103f9 b9009fe1 b9000e99 b40055fc (79401398)
> > [ 6952.548170] ---[ end trace 0000000000000000 ]---
> > [ 6952.551090] ------------[ cut here ]------------
> > 
> > Reading the resulting code in 6.6.142:
> > fs/ext4/extents.c:
> > int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
> > 			struct ext4_map_blocks *map, int flags)
> > {
> > 	struct ext4_ext_path *path = NULL;
> > 	// ...
> > 
> > got_allocated_blocks:
> > 	path = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
> > 	if (IS_ERR(path)) {
> > 		err = PTR_ERR(path);
> > 		/*
> > 		 * Gracefully handle out of space conditions. If the filesystem
> > 		 * is inconsistent, we'll just leak allocated blocks to avoid
> > 		 * causing even more damage.
> > 		 */
> > 		// ...
> > 		goto out;
> > 	}
> > 
> > 	// ...
> > out:
> > 	ext4_free_ext_path(path);
> > 
> > 	trace_ext4_ext_map_blocks_exit(inode, flags, map,
> > 				       err ? err : allocated);
> > 	return err ? err : allocated;
> > }
> > 
> > => Under out of space condition (what LTP does a *LOT*): path is given unmodified to
> > ext4_free_ext_path() that only does a NULL check (no IS_ERR) before
> > dereferencing it. And that produces the oops and then, the LTP failure.
> > 
> > Notably, master commit 6b854d552711 ("ext4: get rid of ppath in get_ext_path()")
> > never got backported to 6.6.y. But does add the IS_ERR_OR_NULL() check
> > to ext4_free_ext_path:
> >  void ext4_free_ext_path(struct ext4_ext_path *path)
> >  {
> > +       if (IS_ERR_OR_NULL(path))
> > +               return;
> > 
> > Thanks!
> 
> Please always cc: the maintainers and developers involved in a patch
> when asking for it to be backported, as we need their approval as well
> before we can do it.
> 

Do we need to revert such patches just like we did for 6.1?
https://lore.kernel.org/all/20260408010208.746177-1-sashal@kernel.org/

CC: Theodore Tso <tytso@mit.edu>

> thanks,
> 
> greg k-h

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2026-06-29  3:09 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-24  9:25 "ext4: get rid of ppath in get_ext_path()" 6.6.y backport request Yoann Congal
2026-06-24  9:38 ` Greg KH
2026-06-24  9:44   ` Yoann Congal
2026-06-29  3:09   ` Jiayuan Chen

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox