mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
commitpull/10/headabc1be13fd
upstream. f2fs specifies the __GFP_ZERO flag for allocating some of its pages. Unfortunately, the page cache also uses the mapping's GFP flags for allocating radix tree nodes. It always masked off the __GFP_HIGHMEM flag, and masks off __GFP_ZERO in some paths, but not all. That causes radix tree nodes to be allocated with a NULL list_head, which causes backtraces like: __list_del_entry+0x30/0xd0 list_lru_del+0xac/0x1ac page_cache_tree_insert+0xd8/0x110 The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the innermost location, and remove it from earlier in the callchain. Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org Fixes:449dd6984d
("mm: keep page cache radix tree nodes in check") Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com> Reported-by: Chris Fries <cfries@google.com> Debugged-by: Minchan Kim <minchan@kernel.org> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Acked-by: Michal Hocko <mhocko@suse.com> Reviewed-by: Jan Kara <jack@suse.cz> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
5e7575c669
commit
90a32d1f0e
|
@ -688,7 +688,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
|
||||||
VM_BUG_ON_PAGE(!PageLocked(new), new);
|
VM_BUG_ON_PAGE(!PageLocked(new), new);
|
||||||
VM_BUG_ON_PAGE(new->mapping, new);
|
VM_BUG_ON_PAGE(new->mapping, new);
|
||||||
|
|
||||||
error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
|
error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
|
||||||
if (!error) {
|
if (!error) {
|
||||||
struct address_space *mapping = old->mapping;
|
struct address_space *mapping = old->mapping;
|
||||||
void (*freepage)(struct page *);
|
void (*freepage)(struct page *);
|
||||||
|
@ -744,7 +744,7 @@ static int __add_to_page_cache_locked(struct page *page,
|
||||||
return error;
|
return error;
|
||||||
}
|
}
|
||||||
|
|
||||||
error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
|
error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
|
||||||
if (error) {
|
if (error) {
|
||||||
if (!huge)
|
if (!huge)
|
||||||
mem_cgroup_cancel_charge(page, memcg, false);
|
mem_cgroup_cancel_charge(page, memcg, false);
|
||||||
|
@ -1486,8 +1486,7 @@ no_page:
|
||||||
if (fgp_flags & FGP_ACCESSED)
|
if (fgp_flags & FGP_ACCESSED)
|
||||||
__SetPageReferenced(page);
|
__SetPageReferenced(page);
|
||||||
|
|
||||||
err = add_to_page_cache_lru(page, mapping, offset,
|
err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
|
||||||
gfp_mask & GFP_RECLAIM_MASK);
|
|
||||||
if (unlikely(err)) {
|
if (unlikely(err)) {
|
||||||
put_page(page);
|
put_page(page);
|
||||||
page = NULL;
|
page = NULL;
|
||||||
|
@ -2275,7 +2274,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
|
||||||
if (!page)
|
if (!page)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
|
||||||
ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
|
ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
|
||||||
if (ret == 0)
|
if (ret == 0)
|
||||||
ret = mapping->a_ops->readpage(file, page);
|
ret = mapping->a_ops->readpage(file, page);
|
||||||
else if (ret == -EEXIST)
|
else if (ret == -EEXIST)
|
||||||
|
|
Loading…
Reference in New Issue