Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 15 Sep 2020 16:52:43 +1000
From:   Stephen Rothwell <sfr@canb.auug.org.au>
To:     Matthew Wilcox <willy@infradead.org>
Cc:     Naresh Kamboju <naresh.kamboju@linaro.org>,
        open list <linux-kernel@vger.kernel.org>,
        X86 ML <x86@kernel.org>, linux-fsdevel@vger.kernel.org,
        linux-mm <linux-mm@kvack.org>,
        Linux-Next Mailing List <linux-next@vger.kernel.org>,
        lkft-triage@lists.linaro.org,
        Andrew Morton <akpm@linux-foundation.org>,
        Hugh Dickins <hughd@google.com>,
        William Kucharski <william.kucharski@oracle.com>,
        gandalf@winds.org, Qian Cai <cai@lca.pw>,
        Mike Kravetz <mike.kravetz@oracle.com>,
        Michal Hocko <mhocko@suse.com>, Yang Shi <shy828301@gmail.com>,
        Shakeel Butt <shakeelb@google.com>
Subject: Re: BUG: kernel NULL pointer dereference, address: RIP:
 0010:shmem_getpage_gfp.isra.0+0x470/0x750
Message-ID: <20200915165243.58379eb7@canb.auug.org.au>
In-Reply-To: <20200914115559.GN6583@casper.infradead.org>
References: <CA+G9fYvmut-pJT-HsFRCxiEzOnkOjC8UcksX4v8jUvyLYeXTkQ@mail.gmail.com>
        <20200914115559.GN6583@casper.infradead.org>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="Sig_/+f/cr_6nZV9WkBfA5oKpYEw";
 protocol="application/pgp-signature"; micalg=pgp-sha256
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

--Sig_/+f/cr_6nZV9WkBfA5oKpYEw
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

Hi all,

On Mon, 14 Sep 2020 12:55:59 +0100 Matthew Wilcox <willy@infradead.org> wro=
te:
>
> On Mon, Sep 14, 2020 at 03:49:43PM +0530, Naresh Kamboju wrote:
> > While running LTP fs on qemu x86 and qemu_i386 these kernel BUGs notice=
d. =20
>=20
> I actually sent the fix for this a couple of days ago [1], but I think An=
drew
> overlooked it while constructing the -mm tree.  Here's a fix you can
> apply to the -mm tree:
>=20
> [1] https://lore.kernel.org/linux-mm/20200912032042.GA6583@casper.infrade=
ad.org/
>=20
> diff --git a/mm/shmem.c b/mm/shmem.c
> index d2a46ef7df43..58bc9e326d0d 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -1793,7 +1793,7 @@ static int shmem_getpage_gfp(struct inode *inode, p=
goff_t index,
>  	struct mm_struct *charge_mm;
>  	struct page *page;
>  	enum sgp_type sgp_huge =3D sgp;
> -	pgoff_t hindex;
> +	pgoff_t hindex =3D index;
>  	int error;
>  	int once =3D 0;
>  	int alloced =3D 0;
> @@ -1822,6 +1822,8 @@ static int shmem_getpage_gfp(struct inode *inode, p=
goff_t index,
>  		return error;
>  	}
> =20
> +	if (page)
> +		hindex =3D page->index;
>  	if (page && sgp =3D=3D SGP_WRITE)
>  		mark_page_accessed(page);
> =20
> @@ -1832,6 +1834,7 @@ static int shmem_getpage_gfp(struct inode *inode, p=
goff_t index,
>  		unlock_page(page);
>  		put_page(page);
>  		page =3D NULL;
> +		hindex =3D index;
>  	}
>  	if (page || sgp =3D=3D SGP_READ)
>  		goto out;
> @@ -1982,7 +1985,7 @@ static int shmem_getpage_gfp(struct inode *inode, p=
goff_t index,
>  		goto unlock;
>  	}
>  out:
> -	*pagep =3D page + index - page->index;
> +	*pagep =3D page + index - hindex;
>  	return 0;
> =20
>  	/*

I have applied that to linux-next today.

--=20
Cheers,
Stephen Rothwell

--Sig_/+f/cr_6nZV9WkBfA5oKpYEw
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEENIC96giZ81tWdLgKAVBC80lX0GwFAl9gZLsACgkQAVBC80lX
0Gz77AgAoAY+prsaroOSKRIkjh3sWJTHc7MQPNpYmYiPMNGzLSHmD36a6PTYgLp2
0NdVGWSG1fLLBeJ5AspWTpkWW3iNNK1i9lkrB0Pz+cQUOqDALueOZguP2hvqTsOY
cZZO7NWdKg6Ro8+vhRB871x6hyf6+ZyX09XttP+xFjrCe6NMm5+L97qkdB0FroIU
RhecVktBv7stSu9NVMm/Vp2HcG1o5ZfL92tJFRJOWeA5hIbccxNvmfCflOJP/MSV
UBxlb+d4uuV/IlwgDJCGwFmL5vkCETlvt1P2f3SKjSxSslRLQFAyC4gSmJDASsNQ
N4ArBRL4ZWZqTs8F/4j0ouw7I1SoPA==
=bre5
-----END PGP SIGNATURE-----

--Sig_/+f/cr_6nZV9WkBfA5oKpYEw--