Re: FAILED: patch "[PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()" failed to apply to 4.4-stable tree

[Nathan Chancellor <natechancellor@gmail.com>]

On Sun, Apr 22, 2018 at 11:33:42AM +0200, gregkh@linuxfoundation.org wrote:
> 
> The patch below does not apply to the 4.4-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
> 
> thanks,
> 
> greg k-h
> 
> ------------------ original commit in Linus's tree ------------------
> 
> From abc1be13fd113ddef5e2d807a466286b864caed3 Mon Sep 17 00:00:00 2001
> From: Matthew Wilcox <mawilcox@microsoft.com>
> Date: Fri, 20 Apr 2018 14:56:20 -0700
> Subject: [PATCH] mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
> 
> f2fs specifies the __GFP_ZERO flag for allocating some of its pages.
> Unfortunately, the page cache also uses the mapping's GFP flags for
> allocating radix tree nodes.  It always masked off the __GFP_HIGHMEM
> flag, and masks off __GFP_ZERO in some paths, but not all.  That causes
> radix tree nodes to be allocated with a NULL list_head, which causes
> backtraces like:
> 
>   __list_del_entry+0x30/0xd0
>   list_lru_del+0xac/0x1ac
>   page_cache_tree_insert+0xd8/0x110
> 
> The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through
> if they are ever used.  Fix them all by using GFP_RECLAIM_MASK at the
> innermost location, and remove it from earlier in the callchain.
> 
> Link: http://lkml.kernel.org/r/20180411060320.14458-2-willy@infradead.org
> Fixes: 449dd6984d0e ("mm: keep page cache radix tree nodes in check")
> Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
> Reported-by: Chris Fries <cfries@google.com>
> Debugged-by: Minchan Kim <minchan@kernel.org>
> Acked-by: Johannes Weiner <hannes@cmpxchg.org>
> Acked-by: Michal Hocko <mhocko@suse.com>
> Reviewed-by: Jan Kara <jack@suse.cz>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> 
> diff --git a/mm/filemap.c b/mm/filemap.c
> index 9276bdb2343c..0604cb02e6f3 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
>  	VM_BUG_ON_PAGE(!PageLocked(new), new);
>  	VM_BUG_ON_PAGE(new->mapping, new);
>  
> -	error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
> +	error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
>  	if (!error) {
>  		struct address_space *mapping = old->mapping;
>  		void (*freepage)(struct page *);
> @@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct page *page,
>  			return error;
>  	}
>  
> -	error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
> +	error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
>  	if (error) {
>  		if (!huge)
>  			mem_cgroup_cancel_charge(page, memcg, false);
> @@ -1585,8 +1585,7 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
>  		if (fgp_flags & FGP_ACCESSED)
>  			__SetPageReferenced(page);
>  
> -		err = add_to_page_cache_lru(page, mapping, offset,
> -				gfp_mask & GFP_RECLAIM_MASK);
> +		err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
>  		if (unlikely(err)) {
>  			put_page(page);
>  			page = NULL;
> @@ -2387,7 +2386,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
>  		if (!page)
>  			return -ENOMEM;
>  
> -		ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
> +		ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
>  		if (ret == 0)
>  			ret = mapping->a_ops->readpage(file, page);
>  		else if (ret == -EEXIST)
> 

It looks like c20cd45eb017 ("mm: allow GFP_{FS,IO} for page_cache_read
page cache allocation") came in during 4.5 and reorganized a few things
around the last section.

If you pick that commit then this one, it will be clean (just tested on
4.4.128).

Nathan