From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-it0-f70.google.com (mail-it0-f70.google.com [209.85.214.70]) by kanga.kvack.org (Postfix) with ESMTP id EE5EF6B0005 for ; Thu, 14 Jul 2016 07:23:01 -0400 (EDT) Received: by mail-it0-f70.google.com with SMTP id g8so147436378itb.2 for ; Thu, 14 Jul 2016 04:23:01 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00116.outbound.protection.outlook.com. [40.107.0.116]) by mx.google.com with ESMTPS id 27si2113652otz.198.2016.07.14.04.23.00 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 14 Jul 2016 04:23:01 -0700 (PDT) From: Andrey Ryabinin Subject: [PATCH] radix-tree: fix radix_tree_iter_retry() for tagged iterators. Date: Thu, 14 Jul 2016 14:19:56 +0300 Message-ID: <1468495196-10604-1-git-send-email-aryabinin@virtuozzo.com> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain Sender: owner-linux-mm@kvack.org List-ID: To: Andrew Morton Cc: Jan Kara , ross.zwisler@linux.intel.com, "Kirill A. Shutemov" , linux-mm@kvack.org, Greg Thelen , Suleiman Souhlal , syzkaller@googlegroups.com, Kostya Serebryany , Alexander Potapenko , Sasha Levin , linux-kernel@vger.kernel.org, Andrey Ryabinin , Konstantin Khlebnikov , Matthew Wilcox , Hugh Dickins , stable@vger.kernel.org radix_tree_iter_retry() resets slot to NULL, but it doesn't reset tags. Then NULL slot and non-zero iter.tags passed to radix_tree_next_slot() leading to crash: RIP: [< inline >] radix_tree_next_slot include/linux/radix-tree.h:473 [] find_get_pages_tag+0x334/0x930 mm/filemap.c:1452 .... Call Trace: [] pagevec_lookup_tag+0x3a/0x80 mm/swap.c:960 [] mpage_prepare_extent_to_map+0x321/0xa90 fs/ext4/inode.c:2516 [] ext4_writepages+0x10be/0x2b20 fs/ext4/inode.c:2736 [] do_writepages+0x97/0x100 mm/page-writeback.c:2364 [] __filemap_fdatawrite_range+0x248/0x2e0 mm/filemap.c:300 [] filemap_write_and_wait_range+0x121/0x1b0 mm/filemap.c:490 [] ext4_sync_file+0x34d/0xdb0 fs/ext4/fsync.c:115 [] vfs_fsync_range+0x10a/0x250 fs/sync.c:195 [< inline >] vfs_fsync fs/sync.c:209 [] do_fsync+0x42/0x70 fs/sync.c:219 [< inline >] SYSC_fdatasync fs/sync.c:232 [] SyS_fdatasync+0x19/0x20 fs/sync.c:230 [] entry_SYSCALL_64_fastpath+0x23/0xc1 arch/x86/entry/entry_64.S:207 We must reset iterator's tags to bail out from radix_tree_next_slot() and go to the slow-path in radix_tree_next_chunk(). Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup") Signed-off-by: Andrey Ryabinin Reported-by: Dmitry Vyukov Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: Hugh Dickins Cc: --- include/linux/radix-tree.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h index cb4b7e8..eca6f62 100644 --- a/include/linux/radix-tree.h +++ b/include/linux/radix-tree.h @@ -407,6 +407,7 @@ static inline __must_check void **radix_tree_iter_retry(struct radix_tree_iter *iter) { iter->next_index = iter->index; + iter->tags = 0; return NULL; } -- 2.7.3 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org