v2 [PATCH] ocfs2: fix panic in failed foilio allocation

Commit Message

Mark Tinguely April 11, 2025, 4:31 p.m. UTC

In the page to order 0 folio conversion series, the commit
7e119cff9d0a, "ocfs2: convert w_pages to w_folios" and
commit 9a5e08652dc4b, "ocfs2: use an array of folios
instead of an array of pages", saves -ENOMEM in the
folio array upon allocation failure and calls the folio
array free code. The folio array free code expects either
valid folio pointers or NULL. Finding the -ENOMEM will
result in a panic. Fix by NULLing the error folio entry.

Signed-off-by: Mark Tinguely <[e-mail]>
Cc: [e-mail]
Cc: Changwei Ge <[e-mail]>
Cc: Joel Becker <[e-mail]>
Cc: Junxiao Bi <[e-mail]>
Cc: Mark Fasheh <[e-mail]>
Cc: Matthew Wilcox <[e-mail]>
---
v2: sorry, ocfs2_grab_folios() needs the same change.
     the other callers do not need the change.
---
  fs/ocfs2/alloc.c | 1 +
  fs/ocfs2/aops.c  | 1 +
  2 files changed, 2 insertions(+)

  		}

Comments

Matthew Wilcox April 11, 2025, 5 p.m. UTC | #1

On Fri, Apr 11, 2025 at 11:31:24AM -0500, Mark Tinguely wrote:
> In the page to order 0 folio conversion series, the commit
> 7e119cff9d0a, "ocfs2: convert w_pages to w_folios" and
> commit 9a5e08652dc4b, "ocfs2: use an array of folios
> instead of an array of pages", saves -ENOMEM in the
> folio array upon allocation failure and calls the folio
> array free code. The folio array free code expects either
> valid folio pointers or NULL. Finding the -ENOMEM will
> result in a panic. Fix by NULLing the error folio entry.
> 
> Signed-off-by: Mark Tinguely <[e-mail]>
> Cc: [e-mail]
> Cc: Changwei Ge <[e-mail]>
> Cc: Joel Becker <[e-mail]>
> Cc: Junxiao Bi <[e-mail]>
> Cc: Mark Fasheh <[e-mail]>
> Cc: Matthew Wilcox <[e-mail]>

Reviewed-by: Matthew Wilcox (Oracle) <[e-mail]>

Joseph Qi April 12, 2025, 11:47 p.m. UTC | #2

On 2025/4/12 00:31, Mark Tinguely wrote:
> In the page to order 0 folio conversion series, the commit
> 7e119cff9d0a, "ocfs2: convert w_pages to w_folios" and
> commit 9a5e08652dc4b, "ocfs2: use an array of folios
> instead of an array of pages", saves -ENOMEM in the
> folio array upon allocation failure and calls the folio
> array free code. The folio array free code expects either
> valid folio pointers or NULL. Finding the -ENOMEM will
> result in a panic. Fix by NULLing the error folio entry.
> 
> Signed-off-by: Mark Tinguely <[e-mail]>

Fixes: 7e119cff9d0a ("ocfs2: convert w_pages to w_folios")
Fixes: 9a5e08652dc4b ("ocfs2: use an array of folios instead of an array of pages")

Reviewed-by: Joseph Qi <[e-mail]>
> Cc: [e-mail]
> Cc: Changwei Ge <[e-mail]>
> Cc: Joel Becker <[e-mail]>
> Cc: Junxiao Bi <[e-mail]>
> Cc: Mark Fasheh <[e-mail]>
> Cc: Matthew Wilcox <[e-mail]>
> ---
> v2: sorry, ocfs2_grab_folios() needs the same change.
>     the other callers do not need the change.
> ---
>  fs/ocfs2/alloc.c | 1 +
>  fs/ocfs2/aops.c  | 1 +
>  2 files changed, 2 insertions(+)
> 
> diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
> index b8ac85b548c7..821cb7874685 100644
> --- a/fs/ocfs2/alloc.c
> +++ b/fs/ocfs2/alloc.c
> @@ -6918,6 +6918,7 @@ static int ocfs2_grab_folios(struct inode *inode, loff_t start, loff_t end,
>          if (IS_ERR(folios[numfolios])) {
>              ret = PTR_ERR(folios[numfolios]);
>              mlog_errno(ret);
> +            folios[numfolios] = NULL;
>              goto out;
>          }
>  diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
> index 40b6bce12951..89aadc6cdd87 100644
> --- a/fs/ocfs2/aops.c
> +++ b/fs/ocfs2/aops.c
> @@ -1071,6 +1071,7 @@ static int ocfs2_grab_folios_for_write(struct address_space *mapping,
>              if (IS_ERR(wc->w_folios[i])) {
>                  ret = PTR_ERR(wc->w_folios[i]);
>                  mlog_errno(ret);
> +                wc->w_folios[i] = NULL;
>                  goto out;
>              }
>          }

Patch

diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index b8ac85b548c7..821cb7874685 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -6918,6 +6918,7 @@  static int ocfs2_grab_folios(struct inode *inode, 
loff_t start, loff_t end,
  		if (IS_ERR(folios[numfolios])) {
  			ret = PTR_ERR(folios[numfolios]);
  			mlog_errno(ret);
+			folios[numfolios] = NULL;
  			goto out;
  		}
  diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 40b6bce12951..89aadc6cdd87 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1071,6 +1071,7 @@  static int ocfs2_grab_folios_for_write(struct 
address_space *mapping,
  			if (IS_ERR(wc->w_folios[i])) {
  				ret = PTR_ERR(wc->w_folios[i]);
  				mlog_errno(ret);
+				wc->w_folios[i] = NULL;
  				goto out;
  			}