lkml.org 
[lkml]   [2021]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [f2fs-dev] [syzbot] BUG: unable to handle kernel NULL pointer dereference in folio_mark_dirty
On 12/07, Matthew Wilcox wrote:
> On Tue, Dec 07, 2021 at 01:39:06PM -0800, Jaegeuk Kim wrote:
> > On 12/07, Matthew Wilcox wrote:
> > > > > Call Trace:
> > > > > <TASK>
> > > > > folio_mark_dirty+0x136/0x270 mm/page-writeback.c:2639
> > >
> > > if (likely(mapping)) {
> > > ...
> > > if (folio_test_reclaim(folio))
> > > folio_clear_reclaim(folio);
> > > return mapping->a_ops->set_page_dirty(&folio->page);
> > >
> > > how do we get to a NULL ->set_page_dirty for a metadata page's
> > > mapping->a_ops? This is definitely an f2fs expert question.
> >
> > I can't find anything in f2fs, since that page was got by f2fs_grab_meta_page
> > along with grab_cache_page() that we never unlocked it.
> >
> > 40 struct page *f2fs_grab_meta_page(struct f2fs_sb_info *sbi, pgoff_t index)
> > 41 {
> > 42 struct address_space *mapping = META_MAPPING(sbi);
> > 43 struct page *page;
> > 44 repeat:
> > 45 page = f2fs_grab_cache_page(mapping, index, false);
> >
> > -> grab_cache_page(mapping, index);
> >
> > 46 if (!page) {
> > 47 cond_resched();
> > 48 goto repeat;
> > 49 }
> > 50 f2fs_wait_on_page_writeback(page, META, true, true);
> > 51 if (!PageUptodate(page))
> > 52 SetPageUptodate(page);
> > 53 return page;
> > 54 }
> >
> >
> > Suspecting something in folio wrt folio_mapping()?
> >
> > 81 bool set_page_dirty(struct page *page)
> > 82 {
> > 83 return folio_mark_dirty(page_folio(page));
> > 84 }
>
> ... huh? How could folio_mapping() be getting this wrong?

Dunno.

> page_folio() does the same thing as compound_head() -- as far as I know
> you don't use compound pages for f2fs metadata, so this basically just
> casts the page to a struct folio.
>
> folio_mapping() is just like the old page_mapping() (see commit
> 2f52578f9c64). Unless you've done something like set the swapcache
> bit on your metadata page, it's just going to return folio->mapping
> (ie the same as page->mapping).

Hmm, I've never seen this call stack before, so simply started to suspect
folio.

\
 
 \ /
  Last update: 2021-12-07 23:11    [W:0.062 / U:0.780 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site