Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) client-ip=2620:137:e000::3:2;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.200.91.1.1\))
Subject: Re: [PATCH] bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
From:   Coly Li <colyli@suse.de>
In-Reply-To: <11a7d768-c6e7-4a6e-875d-87858bf023a5@kernel.dk>
Date:   Sat, 25 Nov 2023 00:42:21 +0800
Cc:     Markus Weippert <markus@gekmihesg.de>,
        Bcache Linux <linux-bcache@vger.kernel.org>,
        Thorsten Leemhuis <regressions@leemhuis.info>,
        Zheng Wang <zyytlz.wz@163.com>, linux-kernel@vger.kernel.org,
        =?utf-8?Q?Stefan_F=C3=B6rster?= <cite@incertum.net>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>,
        Linux kernel regressions list <regressions@lists.linux.dev>
Content-Transfer-Encoding: 8BIT
Message-Id: <640974BB-8D2A-4B64-B8F6-C59E931DDFE4@suse.de>
References: <ZV9ZSyDLNDlzutgQ@pharmakeia.incertum.net>
 <be371028-efeb-44af-90ea-5c307f27d4c6@leemhuis.info>
 <71576a9ff7398bfa4b8c0a1a1a2523383b056168.camel@gekmihesg.de>
 <989C39B9-A05D-4E4F-A842-A4943A29FFD6@suse.de>
 <1c2a1f362d667d36d83a5ba43218bad199855b11.camel@gekmihesg.de>
 <3DF4A87A-2AC1-4893-AE5F-E921478419A9@suse.de>
 <c47d3540ece151a2fb30e1c7b5881cb8922db915.camel@gekmihesg.de>
 <B68E455A-D6EB-4BB9-BD60-F2F8C3C8C21A@suse.de>
 <54706535-208b-43b5-814f-570ffa7b29bb@kernel.dk>
 <910112B4-168D-4ECC-B374-7E6668B778F9@suse.de>
 <11a7d768-c6e7-4a6e-875d-87858bf023a5@kernel.dk>
To:     Jens Axboe <axboe@kernel.dk>
Precedence: bulk


> 2023年11月25日 00:35，Jens Axboe <axboe@kernel.dk> 写道：
> 
> On 11/24/23 9:34 AM, Coly Li wrote:
>> 
>> 
>>> 2023?11?25? 00:31?Jens Axboe <axboe@kernel.dk> ???
>>> 
>>> On 11/24/23 9:29 AM, Coly Li wrote:
>>>> 
>>>> 
>>>>> 2023?11?24? 23:14?Markus Weippert <markus@gekmihesg.de> ???
>>>>> 
>>>>> Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in
>>>>> node allocations") replaced IS_ERR_OR_NULL by IS_ERR. This leads to a
>>>>> NULL pointer dereference.
>>>>> 
>>>>> BUG: kernel NULL pointer dereference, address: 0000000000000080
>>>>> Call Trace:
>>>>> ? __die_body.cold+0x1a/0x1f
>>>>> ? page_fault_oops+0xd2/0x2b0
>>>>> ? exc_page_fault+0x70/0x170
>>>>> ? asm_exc_page_fault+0x22/0x30
>>>>> ? btree_node_free+0xf/0x160 [bcache]
>>>>> ? up_write+0x32/0x60
>>>>> btree_gc_coalesce+0x2aa/0x890 [bcache]
>>>>> ? bch_extent_bad+0x70/0x170 [bcache]
>>>>> btree_gc_recurse+0x130/0x390 [bcache]
>>>>> ? btree_gc_mark_node+0x72/0x230 [bcache]
>>>>> bch_btree_gc+0x5da/0x600 [bcache]
>>>>> ? cpuusage_read+0x10/0x10
>>>>> ? bch_btree_gc+0x600/0x600 [bcache]
>>>>> bch_gc_thread+0x135/0x180 [bcache]
>>>>> 
>>>>> The relevant code starts with:
>>>>> 
>>>>>  new_nodes[0] = NULL;
>>>>> 
>>>>>  for (i = 0; i < nodes; i++) {
>>>>>      if (__bch_keylist_realloc(&keylist, bkey_u64s(&r[i].b->key)))
>>>>>          goto out_nocoalesce;
>>>>>  // ...
>>>>> out_nocoalesce:
>>>>>  // ...
>>>>>  for (i = 0; i < nodes; i++)
>>>>>      if (!IS_ERR(new_nodes[i])) {  // IS_ERR_OR_NULL before
>>>>> 028ddcac477b
>>>>>          btree_node_free(new_nodes[i]);  // new_nodes[0] is NULL
>>>>>          rw_unlock(true, new_nodes[i]);
>>>>>      }
>>>>> 
>>>>> This patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this.
>>>>> 
>>>>> Fixes: 028ddcac477b ("bcache: Remove unnecessary NULL point check in
>>>>> node allocations")
>>>>> Link:
>>>>> https://lore.kernel.org/all/3DF4A87A-2AC1-4893-AE5F-E921478419A9@suse.de/
>>>>> Cc: stable@vger.kernel.org
>>>>> Cc: Zheng Wang <zyytlz.wz@163.com>
>>>>> Cc: Coly Li <colyli@suse.de>
>>>>> Signed-off-by: Markus Weippert <markus@gekmihesg.de>
>>>> 
>>>> Added into my for-next.  Thanks for patching up.
>>> 
>>> We should probably get this into the current release, rather than punt
>>> it to 6.8.
>> 
>> Yes, copied. So far I don?t have other bcache patches for 6.7, I feel
>> I might be redundant if I send you another for -rc4 series with this
>> single patch.
>> 
>> Could you please directly take it into -rc4?
> 
> Sure, I'll just grab it as-is.

Thanks for doing this.

Coly Li