From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753934AbcBEWTm (ORCPT ); Fri, 5 Feb 2016 17:19:42 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:60080 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751259AbcBEWTl (ORCPT ); Fri, 5 Feb 2016 17:19:41 -0500 Date: Fri, 5 Feb 2016 14:19:40 -0800 From: Andrew Morton To: Jeremiah Mahler Cc: linux-kernel@vger.kernel.org, Matthew Wilcox , Hugh Dickins , Mel Gorman , Stephen Rothwell , Konstantin Khlebnikov Subject: Re: [REGRESSION] mm: filemap_map_pages NULL pointer dereference Message-Id: <20160205141940.ecc0110b00347a264c868c43@linux-foundation.org> In-Reply-To: <20160205180502.GA5869@hudson.localdomain> References: <20160205180502.GA5869@hudson.localdomain> X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 5 Feb 2016 10:05:02 -0800 Jeremiah Mahler wrote: > On a Lenovo X1 Carbon running -next (20160201+, 20160203+) I have > experienced several system hangs. I usually notice it first when > my browser (Chrome) stops responding but then other programs will stop > responding as well. The only fix is a reboot. It is sporadic but it > will usually occur once a day. > > In the logs there will be a > > unable to handle kernel NULL pointer dereference This should fix it up. From: Konstantin Khlebnikov Subject: radix-tree: fix oops after radix_tree_iter_retry Helper radix_tree_iter_retry() resets next_index to the current index. In following radix_tree_next_slot current chunk size becomes zero. This isn't checked and it tries to dereference null pointer in slot. Tagged iterator is fine because retry happens only at slot 0 where tag bitmask in iter->tags is filled with single bit. Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup") Signed-off-by: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: Hugh Dickins Cc: Ohad Ben-Cohen Cc: Jeremiah Mahler Cc: Signed-off-by: Andrew Morton --- include/linux/radix-tree.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff -puN include/linux/radix-tree.h~radix-tree-fix-oops-after-radix_tree_iter_retry include/linux/radix-tree.h --- a/include/linux/radix-tree.h~radix-tree-fix-oops-after-radix_tree_iter_retry +++ a/include/linux/radix-tree.h @@ -400,7 +400,7 @@ void **radix_tree_iter_retry(struct radi * @iter: pointer to radix tree iterator * Returns: current chunk size */ -static __always_inline unsigned +static __always_inline long radix_tree_chunk_size(struct radix_tree_iter *iter) { return iter->next_index - iter->index; @@ -434,9 +434,9 @@ radix_tree_next_slot(void **slot, struct return slot + offset + 1; } } else { - unsigned size = radix_tree_chunk_size(iter) - 1; + long size = radix_tree_chunk_size(iter); - while (size--) { + while (--size > 0) { slot++; iter->index++; if (likely(*slot)) _