+ squashfs-fix-leaked-page-locks-when-page-actor-allocation-fails.patch added to mm-nonmm-unstable branch

+ squashfs-fix-leaked-page-locks-when-page-actor-allocation-fails.patch added to mm-nonmm-unstable branch

[Andrew Morton]

The patch titled
     Subject: squashfs: fix leaked page locks when page actor allocation fails
has been added to the -mm mm-nonmm-unstable branch.  Its filename is
     squashfs-fix-leaked-page-locks-when-page-actor-allocation-fails.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/squashfs-fix-leaked-page-locks-when-page-actor-allocation-fails.patch

This patch will later appear in the mm-nonmm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Subject: squashfs: fix leaked page locks when page actor allocation fails
Date: Sun, 27 Sep 2026 12:40:12 +0700

squashfs_readpage_block() grabs and locks the sibling pages of the target
block before it allocates the page actor.  If that allocation fails it
jumps to "out", which only frees the page array, so the locked pages are
never unlocked or released.

A later truncate_inode_pages_range() on the inode, e.g.  from evict() at
umount, then waits forever on the leaked folio lock and the task hangs.

Go through mark_errored instead, which unlocks and puts every page
except the target, which the caller handles.

Link: https://lore.kernel.org/20260927060541.45780-1-ngocthang2710.1999@gmail.com
Fixes: f268eedddf35 ("squashfs: extend "page actor" to handle missing pages")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: <syzbot+65b1e2d8f2d618a93e96@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=65b1e2d8f2d618a93e96
Reviewed-by: Phillip Lougher <squashfs.org.uk>
Cc: <stable@vger.kernel.org>
---

 fs/squashfs/file_direct.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/squashfs/file_direct.c~squashfs-fix-leaked-page-locks-when-page-actor-allocation-fails
+++ a/fs/squashfs/file_direct.c
@@ -70,7 +70,7 @@ int squashfs_readpage_block(struct folio
 	actor = squashfs_page_actor_init_special(msblk, page, pages, expected,
 						start_index << PAGE_SHIFT);
 	if (actor == NULL)
-		goto out;
+		goto mark_errored;
 
 	/* Decompress directly into the page cache buffers */
 	res = squashfs_read_data(inode->i_sb, block, bsize, NULL, actor);
_

Patches currently in -mm which might be from ngocthang2710.1999@gmail.com are

squashfs-fix-leaked-page-locks-when-page-actor-allocation-fails.patch