Messages in this thread | | | Date | Sun, 12 Dec 2021 17:15:00 +0800 | Subject | Re: [f2fs-dev] [syzbot] BUG: unable to handle kernel NULL pointer dereference in folio_mark_dirty | From | Chao Yu <> |
| |
On 2021/12/8 6:10, Jaegeuk Kim wrote: > On 12/07, Matthew Wilcox wrote: >> On Tue, Dec 07, 2021 at 01:39:06PM -0800, Jaegeuk Kim wrote: >>> On 12/07, Matthew Wilcox wrote: >>>>>> Call Trace: >>>>>> <TASK> >>>>>> folio_mark_dirty+0x136/0x270 mm/page-writeback.c:2639 >>>> >>>> if (likely(mapping)) { >>>> ... >>>> if (folio_test_reclaim(folio)) >>>> folio_clear_reclaim(folio); >>>> return mapping->a_ops->set_page_dirty(&folio->page); >>>> >>>> how do we get to a NULL ->set_page_dirty for a metadata page's >>>> mapping->a_ops? This is definitely an f2fs expert question. >>> >>> I can't find anything in f2fs, since that page was got by f2fs_grab_meta_page >>> along with grab_cache_page() that we never unlocked it. >>> >>> 40 struct page *f2fs_grab_meta_page(struct f2fs_sb_info *sbi, pgoff_t index) >>> 41 { >>> 42 struct address_space *mapping = META_MAPPING(sbi); >>> 43 struct page *page; >>> 44 repeat: >>> 45 page = f2fs_grab_cache_page(mapping, index, false); >>> >>> -> grab_cache_page(mapping, index); >>> >>> 46 if (!page) { >>> 47 cond_resched(); >>> 48 goto repeat; >>> 49 } >>> 50 f2fs_wait_on_page_writeback(page, META, true, true); >>> 51 if (!PageUptodate(page)) >>> 52 SetPageUptodate(page); >>> 53 return page; >>> 54 } >>> >>> >>> Suspecting something in folio wrt folio_mapping()? >>> >>> 81 bool set_page_dirty(struct page *page) >>> 82 { >>> 83 return folio_mark_dirty(page_folio(page)); >>> 84 } >> >> ... huh? How could folio_mapping() be getting this wrong? > > Dunno. > >> page_folio() does the same thing as compound_head() -- as far as I know >> you don't use compound pages for f2fs metadata, so this basically just >> casts the page to a struct folio. >> >> folio_mapping() is just like the old page_mapping() (see commit >> 2f52578f9c64). Unless you've done something like set the swapcache >> bit on your metadata page, it's just going to return folio->mapping >> (ie the same as page->mapping). > > Hmm, I've never seen this call stack before, so simply started to suspect > folio.
I'm afraid this is a f2fs bug... :(
folio wasn't merged at the first report time (5.14-rc2).
https://syzkaller.appspot.com/bug?extid=07ff38c9c93ca170de07
I doubt the direct reason of panic may be the same as the one of bug reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=215231
However, I still can't figure out why meta_inode's a_ops will change to f2fs_meta_aops.
Thanks,
> > > _______________________________________________ > Linux-f2fs-devel mailing list > Linux-f2fs-devel@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
| |