https://github.com/torvalds/linux
Revision 170f37d6aa6ad4582eefd7459015de79e244536e authored by Matthew Wilcox (Oracle) on 03 May 2022, 04:09:31 UTC, committed by Matthew Wilcox (Oracle) on 05 May 2022, 04:47:29 UTC
It is unsafe to call folio_next() on a folio unless you hold a reference on it that prevents it from being split or freed. After returning from the iterator, iomap calls folio_end_writeback() which may drop the last reference to the page, or allow the page to be split. If that happens, the iterator will not advance far enough through the bio_vec, leading to assertion failures like the BUG() in folio_end_writeback() that checks we're not trying to end writeback on a page not currently under writeback. Other assertion failures were also seen, but they're all explained by this one bug. Fix the bug by remembering where the next folio starts before returning from the iterator. There are other ways of fixing this bug, but this seems the simplest. Reported-by: Darrick J. Wong <djwong@kernel.org> Tested-by: Darrick J. Wong <djwong@kernel.org> Reported-by: Brian Foster <bfoster@redhat.com> Tested-by: Brian Foster <bfoster@redhat.com> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
1 parent a7391ad
Tip revision: 170f37d6aa6ad4582eefd7459015de79e244536e authored by Matthew Wilcox (Oracle) on 03 May 2022, 04:09:31 UTC
block: Do not call folio_next() on an unreferenced folio
block: Do not call folio_next() on an unreferenced folio
Tip revision: 170f37d
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| LICENSES | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .clang-format | -rw-r--r-- | 16.6 KB |
| .cocciconfig | -rw-r--r-- | 59 bytes |
| .get_maintainer.ignore | -rw-r--r-- | 71 bytes |
| .gitattributes | -rw-r--r-- | 62 bytes |
| .gitignore | -rw-r--r-- | 1.9 KB |
| .mailmap | -rw-r--r-- | 22.2 KB |
| COPYING | -rw-r--r-- | 496 bytes |
| CREDITS | -rw-r--r-- | 98.9 KB |
| Kbuild | -rw-r--r-- | 1.3 KB |
| Kconfig | -rw-r--r-- | 555 bytes |
| MAINTAINERS | -rw-r--r-- | 642.0 KB |
| Makefile | -rw-r--r-- | 63.6 KB |
| README | -rw-r--r-- | 727 bytes |
Computing file changes ...
