From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751453AbcGNNzX (ORCPT ); Thu, 14 Jul 2016 09:55:23 -0400 Received: from mail-db5eur01on0111.outbound.protection.outlook.com ([104.47.2.111]:27200 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750897AbcGNNzV (ORCPT ); Thu, 14 Jul 2016 09:55:21 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; From: Andrey Ryabinin To: Andrew Morton CC: Jan Kara , , "Kirill A. Shutemov" , , "Greg Thelen" , Suleiman Souhlal , , Kostya Serebryany , "Alexander Potapenko" , Sasha Levin , , Andrey Ryabinin , Konstantin Khlebnikov , Matthew Wilcox , Hugh Dickins , Subject: [PATCH] radix-tree: fix radix_tree_iter_retry() for tagged iterators. Date: Thu, 14 Jul 2016 14:19:56 +0300 Message-ID: <1468495196-10604-1-git-send-email-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.7.3 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: AMSPR04CA0039.eurprd04.prod.outlook.com (10.242.87.157) To DB6PR0801MB1303.eurprd08.prod.outlook.com (10.168.11.21) X-MS-Office365-Filtering-Correlation-Id: 9a4260cb-4a8e-4a63-d408-08d3abd930fa X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1303;2:a20kYaXuYSSRwlg2LiVZoMKsgYK8bs72uYyoYAjvlo3wu/na9eF2GAmvd5yDIEuoGpajduMVkJ5UKV0ABM9rymQZmXYklyMT//+vk6P/zFyh0PVq9QzZ0xDZqfdZl8sbf5pEiRRfhcxpajkvRU8cGdl7q+9/z2g5c0pWzpcCT0y7XthI5ibg1GSLn4col6V7;3:EldENgL69MrND6o0h+31mZxc2/O0+ukqBrtHtvE0O/izF/f7+lOsRC2Kn8UkH0fVwyiPswG6JQCzeveXMPbdzZxNa39vVecwXh21Li73sDxrOKZd9I2PuVpXwwOR0za+;25:cKD+imoisMzkbkrqYIIZTt1zd/+kEWnRp96ITMxrD3fxiECnu9i2D7Z1iVcGZ1/mExE4Tmyx5X7IdrwB2pREEN4Jmhavt0qntt0EaMqOA7l5CmWILeUyZ7Thc/hxLLL1DPu9xhoBP6joDzgQ1hfB3jEQ6gZ/2dzeQ3kvHUkMNI4V3hhu4VX4kXnjNR16OWTlRBFgJDQWqQzzU92mcfZwFvq1Z3CBPl2YUmEllHtZ3n79nVWQbzp6mx+isW2t2we+SqSAYuL3eDX+mlpiQFwTRNO6SP1Zc61V6VGK4stvOqKXx7HJQMKqfuF6jZ6r0V1jPbVF3IT+c9rHf2iiQuCfCB5ONegMzMd8W3V2Zuqh+/B+oStJo2xEizSKNPqJmNChawvFDN9cyCVVeb3GMo35QReBdgszf5FX2KKSvOBNK2Q= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0801MB1303; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1303;31:pkKrQ4Ul3I7sE8uCRa3ugcfabfF9g3RFQ2EovDJNttorCFTEdN79woQmSNJEtd5b8Z/nUUzIfAxpo1of6ycx89fNdRp9/IUBN2QrFCJMePS5iv1wtcfW92+7fzN6zVmZrWE9WQdS/RCv+45ChJRrB1LA3Cx/jJ9kw0Xf5g3sLMpa91iFA44XFhyuYpMKsI/7bkGwKC6hI5vtGLvRZY9ikw==;4:ms46JgZIL5pHwcXwLiHbWPfob6BJ0f4fFMRfOVGdGz3YzHDoKUVPaRmeLPzytJsxHv6L2MZxYxSZhpOjbou36TzK+2qBm4RDf4oFcDvJWpl8H999XUs3MZwCWeAxtvlhIckdeYZpb8vFTYcF3BFgaaA/+gdNB+aRpjoC/dx/XfdkW6uesG1sFNikX3T5V9MfLsko4pxQ+wG9fqg1+y4I/dhd8GpNK2G4ct4yCrcHUwfpbpfdus37HidXSB5wid78KHw7ELEExIgI+tVq8J723zEuXqjePFSlQF1q4fHoQcIzhlRb0paIki/dNad08xvuRZxJPUTkCwWGLtM89e0lqg4QdrN9Ewhd3zqPjzwPAErDyOQaVwwyckXpcad+SAii0lhuanmNjZ8UviNA6joD8YKJCx9LmOSvlQgGMKg5bPCGJb85OCpr9pwBfO7UESOvNdNbMj0yDlhvGQJCX+ZZycMuSJncGQ+HLiVRJFevW9IOSvHLtsdkYQL/CQaS2JWWFcPgCvi7G4JN5kBF66EfuQ== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(211936372134217)(228905959029699); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041072)(6043046);SRVR:DB6PR0801MB1303;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0801MB1303; X-Forefront-PRVS: 00032065B2 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(7916002)(189002)(199003)(4326007)(5003940100001)(305945005)(50986999)(189998001)(76506005)(105586002)(6116002)(3846002)(19580405001)(19580395003)(86362001)(76176999)(42186005)(229853001)(2906002)(586003)(53416004)(36756003)(106356001)(8676002)(77096005)(81166006)(81156014)(66066001)(50466002)(2950100001)(68736007)(33646002)(50226002)(110136002)(69596002)(7736002)(7846002)(97736004)(48376002)(101416001)(92566002)(47776003);DIR:OUT;SFP:1102;SCL:1;SRVR:DB6PR0801MB1303;H:localhost.sw.ru;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;DB6PR0801MB1303;23:omSbMpJI1SPq4wNqJ1WV12C2zNoreHpIOfuYkrD?= =?us-ascii?Q?lM6b6tFLAayhW+K85YrsEg3v3muZjr9+7Os5qJ6LZ/iWMesUKuxF6rwiTycR?= =?us-ascii?Q?YDsYwY0wxqwuMqWfAksYRtnpHLcu5U7m95xvMQvtVk4zy9kI4LOrOwMxxFoK?= =?us-ascii?Q?/etQqy2vUzjQHddRrm2CBSkI44CNcvqpPYn+NZKB4wTo9XJ17jcKw1Dkr+lI?= =?us-ascii?Q?rzylD+faLpQK9r22bpWYq1bXrXJmZp/hGkaxWNLj+ZFw2hbi95whmZE7mPEI?= =?us-ascii?Q?uLupznYtBkLuo/vZ21SbxXkf7lmlEILJVVn8kBE0c5n7xja4YxXUIE41ZZLs?= =?us-ascii?Q?EfP1psAfm45FKonFjpGfai3zgJ10Xyt5rb7DwO20DSjLFc8C1ahOXw+j70XB?= =?us-ascii?Q?5/I1tLc/yAhabYywI75Gx/GOBD1jGDEHrU5fcQSTOFhFAVeqLiZicz4A09hD?= =?us-ascii?Q?Tl0+kvN/NBHCQlLO7XA5kc/CrctR0GYkg/A7Sr9xB3XyxLWEwZf9uUJiDGdG?= =?us-ascii?Q?MV3vp3wwMzAr/HgWytmxjy5yH5PnYlmSxuh4ynmqP9GEW5ssyyna7TvvX+KI?= =?us-ascii?Q?IP71tvU5Vr9eZwqjcRNCM17j7AzkQqTXqFKY9ltFeVH/1Gh3leQYZ06SkPgF?= =?us-ascii?Q?Gme/p/fKpxG3/5KY23ulzB0Y/wLS3J8yuBhHX94xyZEhR/aD9dgU1MsZHEcS?= =?us-ascii?Q?4g4famSyPGdbTG0lz/O7HKApRn0020nQxOMmGHxOyMD2KQD1V6RHzndW67jM?= =?us-ascii?Q?zkme3Cgs2VJziMFPzvgNAsU1dCGq82uZz6tL9DHArNp7/LCdBSC6cpj3BkFO?= =?us-ascii?Q?fbOf4XQfNcJbwWy9aMQP1XDr6dW/kNVY6jxpL1wpZ8cUd7EA2TKNkTT48rY2?= =?us-ascii?Q?KgS4xUWq64zImhP27T0SnPOo2IP+mAH6H4rgnVppUZ0U4VT7U0dU81S8oz2J?= =?us-ascii?Q?RF7rp49fEqbT+Xb8T4EuETwsdacOPEbRV+O2MOZf5IWKMHQ2CqJwXGcPqkWE?= =?us-ascii?Q?wQcvKaWTFWCeUzeOSIFFmFdOSsWAJDXRksR+PTeonu8o6Grb8mS8NREwd3JR?= =?us-ascii?Q?Uq1bBVg81NqQVY5XGtY1RYAE6QrFbbq1NmnWPnmipcc70TDGnQ6Hh0JFBRh7?= =?us-ascii?Q?oog38bpmxOy/tBCUScZ+2iM5/LSusAZFZ?= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1303;6:gR+WpBYHcGjNVhijp8IE49VOLU8TdXREzLZkOvUobeJYlHtKZ/99y/6LBf8/9DX//9aPd+ig6MCZuAx8KtkmIW0CZ2oIG8eC/GoWUGuX5ZgCQIDpfzHRC2p+SKpiEVr2NCuTbJVnfW5eD3mIE2dm81Ixq5EEmKZJJ7ZmhIhxp/RVbzG8JCv5y79/Fd7FXeT2GJPJbV8ErmYVpqZVieunmOF7PlSSZ68jkAEmdHPC7bJXqA7+1X6x64ONYt16TP11JRyk1oIr6+yCMPpEXKPlX2d/eqmBKhRjWGVspAL8Qd0XsZBVu1ccC1sJXDH/jSuJ;5:ywLg6nvC/yrEaLKQ9VhzHQfEuJ0hAPVzsDuJ1KTuPo0uqWNnuZD2+ctNkufJjJpKe9CskSudCAGOcNrgrFXAG5DjzZlY/qrSjJUfoOCRKyutl8wKc3GtBWqX121gQS14p3M+RJ0GWktauimjnHV//A==;24:RQJ0XliaxQbDdcUqjxqy39lKBbIm9NXSMKUf4VRMM7V7JMYZ4SUFxIkmCJu/GL6GcYg606jJLvHqO2mjufFp3uR+9TDUJ3H8a62E+GyXu8A=;7:JXfe6EZ3wiWh3IfyJYYrWV1izlB9S3C98vT61G1y4DtSzelvMLMrXZKE9NLScZV6Fl/hPrdk5Mf39IV87Otdgly9f1khDb/RsDh2gZJztnwI14uepRNJkfhImIx7Gk0GVKOglQXx8QWyiledDJFcR6SBxXAPytpt+dgwy5F0R2Lt6whaNRetA9vm1JTBbH41x33LgfbConuiLB4KoZ5n08nyPCEJ6qsoldq275uRGZ7xNEentlLNsXuZgaRil5jz SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1303;20:4+TjVhfzBSzPERhJhrgvaVckHx20lbakaFco8z8hE6ppqKH99ACdV1RM9pPriZCiRk8OiyIXyrRLFvAq5CWVMG2pd2QoqKTlo63zLMl/MBxUbrbJ0HZgpBwNsTY/d3k4hp3zqStySo61FkYEHbDgz1JLT0Mc4BHQZEtmj5drQKE= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2016 11:22:48.2409 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB1303 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org radix_tree_iter_retry() resets slot to NULL, but it doesn't reset tags. Then NULL slot and non-zero iter.tags passed to radix_tree_next_slot() leading to crash: RIP: [< inline >] radix_tree_next_slot include/linux/radix-tree.h:473 [] find_get_pages_tag+0x334/0x930 mm/filemap.c:1452 .... Call Trace: [] pagevec_lookup_tag+0x3a/0x80 mm/swap.c:960 [] mpage_prepare_extent_to_map+0x321/0xa90 fs/ext4/inode.c:2516 [] ext4_writepages+0x10be/0x2b20 fs/ext4/inode.c:2736 [] do_writepages+0x97/0x100 mm/page-writeback.c:2364 [] __filemap_fdatawrite_range+0x248/0x2e0 mm/filemap.c:300 [] filemap_write_and_wait_range+0x121/0x1b0 mm/filemap.c:490 [] ext4_sync_file+0x34d/0xdb0 fs/ext4/fsync.c:115 [] vfs_fsync_range+0x10a/0x250 fs/sync.c:195 [< inline >] vfs_fsync fs/sync.c:209 [] do_fsync+0x42/0x70 fs/sync.c:219 [< inline >] SYSC_fdatasync fs/sync.c:232 [] SyS_fdatasync+0x19/0x20 fs/sync.c:230 [] entry_SYSCALL_64_fastpath+0x23/0xc1 arch/x86/entry/entry_64.S:207 We must reset iterator's tags to bail out from radix_tree_next_slot() and go to the slow-path in radix_tree_next_chunk(). Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup") Signed-off-by: Andrey Ryabinin Reported-by: Dmitry Vyukov Cc: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: Hugh Dickins Cc: --- include/linux/radix-tree.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h index cb4b7e8..eca6f62 100644 --- a/include/linux/radix-tree.h +++ b/include/linux/radix-tree.h @@ -407,6 +407,7 @@ static inline __must_check void **radix_tree_iter_retry(struct radix_tree_iter *iter) { iter->next_index = iter->index; + iter->tags = 0; return NULL; } -- 2.7.3