MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-22 15:03:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
v6.16.10
linux-yocto/fs
History
Jinjiang Tu 21ee79ce93 mm/hugetlb: fix folio is still mapped when deleted 
commit 7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7 upstream.

Migration may be raced with fallocating hole.  remove_inode_single_folio
will unmap the folio if the folio is still mapped.  However, it's called
without folio lock.  If the folio is migrated and the mapped pte has been
converted to migration entry, folio_mapped() returns false, and won't
unmap it.  Due to extra refcount held by remove_inode_single_folio,
migration fails, restores migration entry to normal pte, and the folio is
mapped again.  As a result, we triggered BUG in filemap_unaccount_folio.

The log is as follows:
 BUG: Bad page cache in process hugetlb  pfn:156c00
 page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00
 head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0
 aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file"
 flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff)
 page_type: f4(hugetlb)
 page dumped because: still mapped when deleted
 CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE
 Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
 Call Trace:
  <TASK>
  dump_stack_lvl+0x4f/0x70
  filemap_unaccount_folio+0xc4/0x1c0
  __filemap_remove_folio+0x38/0x1c0
  filemap_remove_folio+0x41/0xd0
  remove_inode_hugepages+0x142/0x250
  hugetlbfs_fallocate+0x471/0x5a0
  vfs_fallocate+0x149/0x380

Hold folio lock before checking if the folio is mapped to avold race with
migration.

Link: https://lkml.kernel.org/r/20250912074139.3575005-1-tujinjiang@huawei.com
Fixes: 4aae8d1c05 ("mm/hugetlbfs: unmap pages if page fault raced with hole punch")
Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-10-02 13:48:38 +02:00
..
9p vfs-6.16-rc1.netfs 2025-06-02 15:04:06 -07:00
adfs
affs vfs-6.15-rc1.async.dir 2025-03-24 10:47:14 -07:00
afs afs: Fix potential null pointer dereference in afs_put_server 2025-10-02 13:48:37 +02:00
autofs VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
bcachefs bcachefs: Add missing snapshots_seen_add_inorder() 2025-07-24 22:56:37 -04:00
befs
bfs bfs: convert bfs to use the new mount api 2025-04-07 09:36:20 +02:00
btrfs btrfs: don't allow adding block device of less than 1 MB 2025-10-02 13:48:28 +02:00
cachefiles cachefiles: Fix the incorrect return value in __cachefiles_write() 2025-07-10 09:40:17 +02:00
ceph ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error 2025-09-19 16:37:33 +02:00
coda
configfs - The 3 patch series "hung_task: extend blocking task stacktrace dump to 2025-05-31 19:12:53 -07:00
cramfs
crypto fscrypt: Don't use problematic non-inline crypto engines 2025-08-20 18:40:48 +02:00
debugfs debugfs: fix mount options not being applied 2025-08-28 16:34:38 +02:00
devpts devpts: Fix type for uid and gid params 2025-04-07 15:22:12 +02:00
dlm treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ecryptfs VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
efivarfs efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare 2025-09-04 16:55:43 +02:00
efs
erofs erofs: fix runtime warning on truncate_folio_batch_exceptionals() 2025-09-19 16:37:38 +02:00
exfat exfat: add cluster chain loop check for dir 2025-08-20 18:41:29 +02:00
exportfs readdir: supply dir_context.count as readdir buffer size hint 2025-05-29 12:31:23 +02:00
ext2 ext2: Handle fiemap on empty files to prevent EINVAL 2025-08-20 18:40:56 +02:00
ext4 ext4: fix hole length calculation overflow in non-extent inodes 2025-08-28 16:34:15 +02:00
f2fs f2fs: fix to avoid out-of-boundary access in dnode page 2025-08-28 16:34:25 +02:00
fat
freevxfs
fuse fuse: prevent overflow in copy_file_range return value 2025-09-19 16:37:31 +02:00
gfs2 gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops 2025-08-20 18:40:54 +02:00
hfs hfs: fix not erasing deleted b-tree node issue 2025-08-20 18:40:55 +02:00
hfsplus hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() 2025-08-20 18:40:53 +02:00
hostfs Updates for UML for this cycle, notably: 2025-04-02 12:25:03 -07:00
hpfs
hugetlbfs mm/hugetlb: fix folio is still mapped when deleted 2025-10-02 13:48:38 +02:00
iomap iomap: Fix broken data integrity guarantees for O_SYNC writes 2025-08-28 16:34:25 +02:00
isofs isofs: Verify inode mode when loading from disk 2025-07-11 11:39:31 +02:00
jbd2 jbd2: prevent softlockup in jbd2_log_do_checkpoint() 2025-08-28 16:34:25 +02:00
jffs2 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places 2025-05-22 20:54:38 +02:00
jfs jfs: upper bound check of tree index in dbAllocAG 2025-08-20 18:41:23 +02:00
kernfs kernfs: Fix UAF in polling when open file is released 2025-09-19 16:37:33 +02:00
lockd
minix
netfs netfs: fix reference leak 2025-10-02 13:48:38 +02:00
nfs NFSv4.2: Protect copy offload and clone against 'eof page pollution' 2025-10-02 13:48:28 +02:00
nfs_common NFS/localio: nfs_uuid_put() fix the wake up after unlinking the file 2025-08-15 16:39:27 +02:00
nfsd NFSD: detect mismatch of file handle and delegation stateid in OPEN op 2025-08-20 18:40:47 +02:00
nilfs2 nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* 2025-09-25 11:16:45 +02:00
nls
notify fanotify: sanitize handle_type values when reporting fid 2025-08-15 16:39:02 +02:00
ntfs3 fs/ntfs3: correctly create symlink for relative path 2025-08-20 18:40:55 +02:00
ocfs2 ocfs2: fix recursive semaphore deadlock in fiemap call 2025-09-19 16:37:30 +02:00
omfs omfs: convert to new mount API 2025-04-28 10:54:39 +02:00
openpromfs
orangefs fs/orangefs: use snprintf() instead of sprintf() 2025-08-20 18:41:22 +02:00
overlayfs ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() 2025-08-28 16:34:41 +02:00
proc fs/proc/task_mmu: check p->vec_buf for NULL 2025-10-02 13:48:38 +02:00
pstore treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
qnx4
qnx6
quota VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
ramfs
resctrl fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters 2025-09-19 16:37:34 +02:00
romfs
smb smb: client: fix wrong index reference in smb2_compound_op() 2025-10-02 13:48:34 +02:00
squashfs squashfs: fix memory leak in squashfs_fill_super 2025-08-28 16:34:35 +02:00
sysfs sysfs: constify attribute_group::bin_attrs 2025-04-15 18:46:10 +02:00
tests
tracefs tracefs: Add d_delete to remove negative dentries 2025-08-20 18:40:56 +02:00
ubifs This pull request contains the following fixes for JFFS2 and UBIFS: 2025-06-07 07:24:07 -07:00
udf udf: Verify partition map count 2025-08-20 18:40:54 +02:00
ufs fix the regression in ufs options parsing 2025-07-23 11:45:04 -04:00
unicode
vboxsf vboxsf: Convert to writepages 2025-04-07 09:36:48 +02:00
verity
xfs xfs: do not propagate ENODATA disk errors into xattr code 2025-09-04 16:55:48 +02:00
zonefs zonefs: use bdev_rw_virt in zonefs_read_super 2025-05-07 07:31:07 -06:00
aio.c fs: aio: initialize .ki_write_stream of read-write request 2025-05-07 08:00:11 -06:00
anon_inodes.c fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass 2025-06-23 12:41:17 +02:00
attr.c
backing-file.c
bad_inode.c
binfmt_elf_fdpic.c
binfmt_elf.c vfs-6.16-rc1.misc 2025-05-26 09:02:39 -07:00
binfmt_flat.c
binfmt_misc.c VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
binfmt_script.c
bpf_fs_kfuncs.c
buffer.c fs/buffer: fix use-after-free when call bh_read() helper 2025-08-28 16:34:38 +02:00
char_dev.c
compat_binfmt_elf.c
coredump.c coredump: don't pointlessly check and spew warnings 2025-09-19 16:37:26 +02:00
d_path.c
dax.c vfs-6.16-rc2.fixes 2025-06-02 12:49:16 -07:00
dcache.c vfs-6.16-rc1.misc 2025-05-26 09:02:39 -07:00
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c eventpoll: fix sphinx documentation build warning 2025-08-15 16:38:24 +02:00
exec.c coredump: don't pointlessly check and spew warnings 2025-09-19 16:37:26 +02:00
fcntl.c
fhandle.c fhandle: use more consistent rules for decoding file handle from userns 2025-09-19 16:37:26 +02:00
file_table.c fs: Make file-nr output the total allocated file handles 2025-04-21 10:27:58 +02:00
file.c fs: Prevent file descriptor table allocations exceeding INT_MAX 2025-08-20 18:40:48 +02:00
filesystems.c fs/filesystems: Fix potential unsigned integer underflow in fs_name() 2025-04-14 13:05:59 +02:00
fs_context.c fs/fs_context: Mark an unlikely if condition with unlikely() in vfs_parse_monolithic_sep() 2025-04-14 13:05:59 +02:00
fs_parser.c fs/fs_parse: Remove unused and problematic validate_constant_table() 2025-04-21 10:27:59 +02:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c fs: writeback: fix use-after-free in __mark_inode_dirty() 2025-09-09 19:02:16 +02:00
fsopen.c
init.c
inode.c fs: call inode_sb_list_add() outside of inode hash lock 2025-03-20 13:06:51 +01:00
internal.h libfs: massage path_from_stashed() to allow custom stashing behavior 2025-08-28 16:34:38 +02:00
ioctl.c vfs-6.16-rc1.super 2025-05-26 09:33:44 -07:00
Kconfig fs/resctrl: Add boiler plate for external resctrl code 2025-05-16 11:05:40 +02:00
Kconfig.binfmt
kernel_read_file.c
libfs.c libfs: massage path_from_stashed() to allow custom stashing behavior 2025-08-28 16:34:38 +02:00
locks.c
Makefile fs/resctrl: Add boiler plate for external resctrl code 2025-05-16 11:05:40 +02:00
mbcache.c
mnt_idmapping.c
mount.h Don't propagate mounts into detached trees 2025-05-26 17:35:32 -04:00
mpage.c fs: use writeback_iter directly in mpage_writepages 2025-05-09 12:37:48 +02:00
namei.c vfs-6.16-rc5.fixes 2025-07-04 09:06:49 -07:00
namespace.c use uniform permission checks for all mount propagation changes 2025-08-28 16:34:38 +02:00
nsfs.c vfs-6.15-rc1.nsfs 2025-03-24 11:38:12 -07:00
open.c fs/open: make do_truncate() killable 2025-05-15 12:03:12 +02:00
pidfs.c pidfs: raise SB_I_NODEV and SB_I_NOEXEC 2025-08-20 18:40:55 +02:00
pipe.c sort.h: hoist cmp_int() into generic header file 2025-05-11 17:54:12 -07:00
pnode.c Don't propagate mounts into detached trees 2025-05-26 17:35:32 -04:00
pnode.h replace collect_mounts()/drop_collected_mounts() with a safer variant 2025-06-23 14:01:49 -04:00
posix_acl.c
proc_namespace.c ->mnt_devname is never NULL 2025-05-23 14:20:44 +02:00
read_write.c fs/read_write: make default_llseek() killable 2025-05-15 12:03:12 +02:00
readdir.c readdir: supply dir_context.count as readdir buffer size hint 2025-05-29 12:31:23 +02:00
remap_range.c
select.c select: core_sys_select add unlikely branch hint on return path 2025-04-21 10:27:58 +02:00
seq_file.c
signalfd.c
splice.c netfs: Fix unbuffered write error handling 2025-08-28 16:34:13 +02:00
stack.c
stat.c xfs: New code for 6.16 2025-05-26 12:56:01 -07:00
statfs.c
super.c fs: unlock the superblock during iterate_supers_type 2025-06-12 14:27:39 +02:00
sync.c
sysctls.c
timerfd.c A treewide hrtimer timer cleanup 2025-03-25 10:54:15 -07:00
userfaultfd.c mm/userfaultfd: fix uninitialized output field for -EAGAIN race 2025-05-07 23:39:39 -07:00
utimes.c
xattr.c fs/xattr.c: fix simple_xattr_list() 2025-06-06 10:00:17 +02:00