MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-22 15:03:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
72b82d56b8
linux-yocto/fs
History
Jinjiang Tu 910d774934 mm/hugetlb: fix folio is still mapped when deleted 
commit 7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7 upstream.

Migration may be raced with fallocating hole.  remove_inode_single_folio
will unmap the folio if the folio is still mapped.  However, it's called
without folio lock.  If the folio is migrated and the mapped pte has been
converted to migration entry, folio_mapped() returns false, and won't
unmap it.  Due to extra refcount held by remove_inode_single_folio,
migration fails, restores migration entry to normal pte, and the folio is
mapped again.  As a result, we triggered BUG in filemap_unaccount_folio.

The log is as follows:
 BUG: Bad page cache in process hugetlb  pfn:156c00
 page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00
 head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0
 aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file"
 flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff)
 page_type: f4(hugetlb)
 page dumped because: still mapped when deleted
 CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE
 Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
 Call Trace:
  <TASK>
  dump_stack_lvl+0x4f/0x70
  filemap_unaccount_folio+0xc4/0x1c0
  __filemap_remove_folio+0x38/0x1c0
  filemap_remove_folio+0x41/0xd0
  remove_inode_hugepages+0x142/0x250
  hugetlbfs_fallocate+0x471/0x5a0
  vfs_fallocate+0x149/0x380

Hold folio lock before checking if the folio is mapped to avold race with
migration.

Link: https://lkml.kernel.org/r/20250912074139.3575005-1-tujinjiang@huawei.com
Fixes: 4aae8d1c05 ("mm/hugetlbfs: unmap pages if page fault raced with hole punch")
Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-10-02 13:44:14 +02:00
..
9p 9p: Add a migrate_folio method 2025-06-19 15:32:36 +02:00
adfs move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
affs affs: don't write overlarge OFS data block size fields 2025-04-10 14:39:29 +02:00
afs afs: Fix potential null pointer dereference in afs_put_server 2025-10-02 13:44:14 +02:00
autofs autofs: fix thinko in validate_dev_ioctl() 2024-10-28 13:16:56 +01:00
bcachefs add a string-to-qstr constructor 2025-07-10 16:05:08 +02:00
befs
bfs
btrfs btrfs: don't allow adding block device of less than 1 MB 2025-10-02 13:44:08 +02:00
cachefiles cachefiles: Fix the incorrect return value in __cachefiles_write() 2025-07-24 08:56:30 +02:00
ceph ceph: fix race condition where r_parent becomes stale before sending message 2025-09-19 16:35:47 +02:00
coda
configfs configfs: Do not override creating attribute file failure in populate_attrs() 2025-06-27 11:11:12 +01:00
cramfs
crypto fscrypt: Don't use problematic non-inline crypto engines 2025-08-20 18:30:15 +02:00
debugfs debugfs: fix mount options not being applied 2025-08-28 16:31:08 +02:00
devpts
dlm dlm: make tcp still work in multi-link env 2025-05-29 11:02:14 +02:00
ecryptfs move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
efivarfs efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare 2025-09-04 15:31:52 +02:00
efs efs: fix the efs new mount api implementation 2024-12-05 14:01:10 +01:00
erofs erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC 2025-09-04 15:31:44 +02:00
exfat exfat: add cluster chain loop check for dir 2025-08-20 18:30:47 +02:00
exportfs
ext2 ext2: Handle fiemap on empty files to prevent EINVAL 2025-08-20 18:30:21 +02:00
ext4 ext4: introduce linear search for dentries 2025-09-19 16:35:42 +02:00
f2fs f2fs: fix to avoid out-of-boundary access in dnode page 2025-08-28 16:30:59 +02:00
fat fat: fix uninitialized variable 2024-10-17 00:28:06 -07:00
freevxfs
fuse fuse: prevent overflow in copy_file_range return value 2025-09-19 16:35:46 +02:00
gfs2 gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops 2025-08-20 18:30:20 +02:00
hfs hfs: fix not erasing deleted b-tree node issue 2025-08-20 18:30:20 +02:00
hfsplus hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() 2025-08-20 18:30:19 +02:00
hostfs um: hostfs: avoid issues on inode number reuse by host 2025-04-10 14:39:25 +02:00
hpfs move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
hugetlbfs mm/hugetlb: fix folio is still mapped when deleted 2025-10-02 13:44:14 +02:00
iomap iomap: skip unnecessary ifs_block_is_uptodate check 2025-05-02 07:59:27 +02:00
isofs isofs: Verify inode mode when loading from disk 2025-07-24 08:56:25 +02:00
jbd2 jbd2: prevent softlockup in jbd2_log_do_checkpoint() 2025-08-28 16:30:59 +02:00
jffs2 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places 2025-06-27 11:11:37 +01:00
jfs jfs: upper bound check of tree index in dbAllocAG 2025-08-20 18:30:42 +02:00
kernfs kernfs: Fix UAF in polling when open file is released 2025-09-19 16:35:47 +02:00
lockd move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
minix
netfs netfs: Fix unbuffered write error handling 2025-08-28 16:31:04 +02:00
nfs NFSv4/flexfiles: Fix layout merge mirror check. 2025-09-19 16:35:44 +02:00
nfs_common nfs: fix incorrect error handling in LOCALIO 2025-02-08 09:57:59 +01:00
nfsd NFSD: detect mismatch of file handle and delegation stateid in OPEN op 2025-08-20 18:30:14 +02:00
nilfs2 nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* 2025-09-25 11:13:45 +02:00
nls move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
notify fanotify: sanitize handle_type values when reporting fid 2025-08-15 12:13:51 +02:00
ntfs3 fs/ntfs3: correctly create symlink for relative path 2025-08-20 18:30:21 +02:00
ocfs2 ocfs2: fix recursive semaphore deadlock in fiemap call 2025-09-19 16:35:45 +02:00
omfs
openpromfs
orangefs fs/orangefs: use snprintf() instead of sprintf() 2025-08-20 18:30:41 +02:00
overlayfs ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() 2025-08-28 16:31:10 +02:00
proc fs/proc/task_mmu: check p->vec_buf for NULL 2025-10-02 13:44:14 +02:00
pstore pstore: Change kmsg_bytes storage size to u32 2025-05-29 11:02:58 +02:00
qnx4
qnx6 fs/qnx6: Fix building with GCC 15 2025-01-23 17:22:55 +01:00
quota quota: flush quota_release_work upon quota writeback 2024-12-09 10:40:55 +01:00
ramfs
reiserfs move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
romfs
smb smb: client: fix wrong index reference in smb2_compound_op() 2025-10-02 13:44:12 +02:00
squashfs squashfs: fix memory leak in squashfs_fill_super 2025-08-28 16:31:05 +02:00
sysfs
sysv
tests
tracefs tracefs: Add d_delete to remove negative dentries 2025-08-20 18:30:21 +02:00
ubifs ubifs: skip dumping tnc tree when zroot is null 2025-02-08 09:58:01 +01:00
udf udf: Verify partition map count 2025-08-20 18:30:20 +02:00
ufs ufs_rename(): fix bogus argument of folio_release_kmap() 2024-10-02 00:05:09 -04:00
unicode Revert "unicode: Don't special case ignorable code points" 2024-12-14 20:04:13 +01:00
vboxsf vboxsf: fix building with GCC 15 2025-03-22 12:54:15 -07:00
verity
xfs xfs: do not propagate ENODATA disk errors into xattr code 2025-09-04 15:31:54 +02:00
zonefs zonefs fixes for 6.12-rc2 2024-10-02 12:02:15 -07:00
aio.c
anon_inodes.c fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass 2025-07-10 16:05:09 +02:00
attr.c
backing-file.c fs: pass offset and result to backing_file end_write() callback 2024-10-16 13:17:45 +02:00
bad_inode.c
binfmt_elf_fdpic.c Revert "fs: don't block i_writecount during exec" 2024-12-05 14:02:50 +01:00
binfmt_elf.c binfmt_elf: Move brk for static PIE even if ASLR disabled 2025-05-22 14:29:35 +02:00
binfmt_flat.c binfmt_flat: Fix integer overflow bug on 32 bit systems 2025-02-17 10:05:04 +01:00
binfmt_misc.c Revert "fs: don't block i_writecount during exec" 2024-12-05 14:02:50 +01:00
binfmt_script.c
bpf_fs_kfuncs.c
buffer.c fs/buffer: fix use-after-free when call bh_read() helper 2025-08-28 16:31:08 +02:00
char_dev.c
compat_binfmt_elf.c
coredump.c coredump: hand a pidfd to the usermode coredump helper 2025-06-04 14:43:52 +02:00
d_path.c
dax.c fsdax: dax_unshare_iter needs to copy entire blocks 2024-10-07 13:51:47 +02:00
dcache.c vfs-6.12.misc 2024-09-16 08:35:09 +02:00
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c eventpoll: Fix semi-unbounded recursion 2025-08-20 18:30:15 +02:00
exec.c exec: fix the racy usage of fs_struct->in_exec 2025-04-10 14:39:40 +02:00
fcntl.c fcntl: make F_DUPFD_QUERY associative 2024-12-05 14:02:47 +01:00
fhandle.c fhandle: use more consistent rules for decoding file handle from userns 2025-09-19 16:35:41 +02:00
file_table.c add a string-to-qstr constructor 2025-07-10 16:05:08 +02:00
file.c alloc_fdtable(): change calling conventions. 2025-08-28 16:31:16 +02:00
filesystems.c fs/filesystems: Fix potential unsigned integer underflow in fs_name() 2025-06-19 15:32:32 +02:00
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c fs: writeback: fix use-after-free in __mark_inode_dirty() 2025-09-09 18:58:03 +02:00
fsopen.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
init.c
inode.c bcachefs: do not use PF_MEMALLOC_NORECLAIM 2024-10-09 12:47:18 -07:00
internal.h
ioctl.c
Kconfig nfs: add missing selections of CONFIG_CRC32 2025-04-25 10:47:50 +02:00
Kconfig.binfmt
kernel_read_file.c
libfs.c better lockdep annotations for simple_recursive_removal() 2025-08-20 18:30:20 +02:00
locks.c struct fd layout change (and conversion to accessor helpers) 2024-09-23 09:35:36 -07:00
Makefile
mbcache.c
mnt_idmapping.c fuse update for 6.12 2024-09-24 15:29:42 -07:00
mount.h fs: kill MNT_ONRB 2025-01-17 13:40:50 +01:00
mpage.c fs/writeback: convert wbc_account_cgroup_owner to take a folio 2025-01-17 13:40:33 +01:00
namei.c fuse: don't truncate cached, mutated symlink 2025-03-22 12:54:20 -07:00
namespace.c fs/fhandle.c: fix a race in call of has_locked_children() 2025-09-09 18:58:19 +02:00
nsfs.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
open.c openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) 2024-10-10 12:09:03 +02:00
pidfs.c pidfs: raise SB_I_NODEV and SB_I_NOEXEC 2025-08-20 18:30:21 +02:00
pipe.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() 2024-12-05 14:01:11 +01:00
readdir.c
remap_range.c
select.c select: Fix unbalanced user_access_end() 2025-02-08 09:56:53 +01:00
seq_file.c
signalfd.c struct fd layout change (and conversion to accessor helpers) 2024-09-23 09:35:36 -07:00
splice.c netfs: Fix unbuffered write error handling 2025-08-28 16:31:04 +02:00
stack.c
stat.c
statfs.c
super.c fs/super.c: introduce get_tree_bdev_flags() 2024-10-21 14:30:26 +02:00
sync.c
sysctls.c
timerfd.c
userfaultfd.c mm/userfaultfd: fix uninitialized output field for -EAGAIN race 2025-05-18 08:24:52 +02:00
utimes.c
xattr.c fs/xattr.c: fix simple_xattr_list() 2025-06-27 11:11:36 +01:00