mirror of
https://github.com/Fishwaldo/Star64_linux.git
synced 2025-03-15 19:55:32 +00:00
nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
commit f83913f8c5
upstream.
A syzbot stress test reported that create_empty_buffers() called from
nilfs_lookup_dirty_data_buffers() can cause a general protection fault.
Analysis using its reproducer revealed that the back reference "mapping"
from a page/folio has been changed to NULL after dirty page/folio gang
lookup in nilfs_lookup_dirty_data_buffers().
Fix this issue by excluding pages/folios from being collected if, after
acquiring a lock on each page/folio, its back reference "mapping" differs
from the pointer to the address space struct that held the page/folio.
Link: https://lkml.kernel.org/r/20230805132038.6435-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+0ad741797f4565e7e2d2@syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/0000000000002930a705fc32b231@google.com
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
c05cef6ff7
commit
a4ba65ce76
1 changed files with 5 additions and 0 deletions
|
@ -725,6 +725,11 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode,
|
|||
struct page *page = pvec.pages[i];
|
||||
|
||||
lock_page(page);
|
||||
if (unlikely(page->mapping != mapping)) {
|
||||
/* Exclude pages removed from the address space */
|
||||
unlock_page(page);
|
||||
continue;
|
||||
}
|
||||
if (!page_has_buffers(page))
|
||||
create_empty_buffers(page, i_blocksize(inode), 0);
|
||||
unlock_page(page);
|
||||
|
|
Loading…
Add table
Reference in a new issue