| Message ID | 20220619151143.1054746-3-willy@infradead.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fixes for 5.19b | expand |
On Sun, Jun 19, 2022 at 04:11:42PM +0100, Matthew Wilcox (Oracle) wrote: > If a read races with an invalidation followed by another read, it is > possible for a folio to be replaced with a higher-order folio. If that > happens, we'll see a sibling entry for the new folio in the next iteration > of the loop. This manifests as a NULL pointer dereference while holding > the RCU read lock. > > Handle this by simply returning. The next call will find the new folio > and handle it correctly. The other ways of handling this rare race are > more complex and it's just not worth it. > > Reported-by: Dave Chinner <david@fromorbit.com> > Reported-by: Brian Foster <bfoster@redhat.com> > Debugged-by: Brian Foster <bfoster@redhat.com> > Tested-by: Brian Foster <bfoster@redhat.com> > Fixes: cbd59c48ae2b ("mm/filemap: use head pages in generic_file_buffered_read") > Cc: stable@vger.kernel.org > Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> > --- This has survived my testing for several days now. I think I grok the fix and analysis that lead to it, so FWIW: Reviewed-by: Brian Foster <bfoster@redhat.com> > mm/filemap.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/mm/filemap.c b/mm/filemap.c > index 577068868449..ffdfbc8b0e3c 100644 > --- a/mm/filemap.c > +++ b/mm/filemap.c > @@ -2385,6 +2385,8 @@ static void filemap_get_read_batch(struct address_space *mapping, > continue; > if (xas.xa_index > max || xa_is_value(folio)) > break; > + if (xa_is_sibling(folio)) > + break; > if (!folio_try_get_rcu(folio)) > goto retry; > > -- > 2.35.1 >
diff --git a/mm/filemap.c b/mm/filemap.c index 577068868449..ffdfbc8b0e3c 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -2385,6 +2385,8 @@ static void filemap_get_read_batch(struct address_space *mapping, continue; if (xas.xa_index > max || xa_is_value(folio)) break; + if (xa_is_sibling(folio)) + break; if (!folio_try_get_rcu(folio)) goto retry;