Received-SPF: pass (google.com: domain of linux-kernel+bounces-80602-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Roman Smirnov <r.smirnov@omp.ru>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>, Greg Kroah-Hartman
	<gregkh@linuxfoundation.org>
CC: "Matthew Wilcox (Oracle)" <willy@infradead.org>, Andrew Morton
	<akpm@linux-foundation.org>, Alexey Khoroshilov <khoroshilov@ispras.ru>,
	Sergey Shtylyov <s.shtylyov@omp.ru>, Karina Yankevich <k.yankevich@omp.ru>,
	"lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>,
	"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"linux-mm@kvack.org" <linux-mm@kvack.org>
Subject: Re: [PATCH 5.10/5.15 v2 0/1 RESEND] mm/truncate: fix WARNING in
 ext4_set_page_dirty()
Thread-Topic: [PATCH 5.10/5.15 v2 0/1 RESEND] mm/truncate: fix WARNING in
 ext4_set_page_dirty()
Thread-Index: AQHaXoZYls/GR/0zTEaYvL5Vg1anPrEcPxk2
Date: Mon, 26 Feb 2024 06:45:12 +0000
Message-ID: <f406f7b3901e4471ab1ecd432aba695b@omp.ru>
References: <20240213140933.632481-1-r.smirnov@omp.ru>
In-Reply-To: <20240213140933.632481-1-r.smirnov@omp.ru>
Accept-Language: ru-RU, en-US
Content-Language: ru-RU
x-kse-attachment-filter-triggered-filters: Clean
x-kse-bulkmessagesfiltering-scan-result: InTheLimit
Content-Type: text/plain; charset="koi8-r"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0

On Tue, 13 Feb, 2024 14:09:33 +0000, Roman Smirnov wrote:
> Syzkaller reports warning in ext4_set_page_dirty() in 5.10 and 5.15
> stable releases. It happens because invalidate_inode_page() frees pages
> that are needed for the system. To fix this we need to add additional
> checks to the function. page_mapped() checks if a page exists in the
> page tables, but this is not enough. The page can be used in other places=
:
> https://elixir.bootlin.com/linux/v6.8-rc1/source/include/linux/page_ref.h=
#L71
>
> Kernel outputs an error line related to direct I/O:
> https://syzkaller.appspot.com/text?tag=3DCrashLog&x=3D14ab52dac80000
>
> The problem can be fixed in 5.10 and 5.15 stable releases by the
> following patch.
>
> The patch replaces page_mapped() call with check that finds additional
> references to the page excluding page cache and filesystem private data.
> If additional references exist, the page cannot be freed.
>
> This version does not include the first patch from the first version.
> The problem can be fixed without it.
>
> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
>
> Link: https://syzkaller.appspot.com/bug?extid=3D02f21431b65c214aa1d6
>
> Previous discussion:
> https://lore.kernel.org/all/20240125130947.600632-1-r.smirnov@omp.ru/T/
>
> Matthew Wilcox (Oracle) (1):
>   mm/truncate: Replace page_mapped() call in invalidate_inode_page()
>
>  mm/truncate.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Hello.=20

Sorry to bother you, do you have any comments on the patch?