Matthew Wilcox wrote on Thu, Feb 20, 2025 at 04:15:53PM +0000: > On Thu, Feb 20, 2025 at 08:00:24AM -0800, syzbot wrote: > > ------------[ cut here ]------------ > > kernel BUG at mm/filemap.c:1499! > > Tried to unlock a folio that wasn't locked. > > The entire log is interesting: > > https://syzkaller.appspot.com/x/log.txt?x=12af2fdf980000 > > It injects a failure which hits p9_tag_alloc() (so adding the 9p people > to the cc) 9p is calling iov_iter_revert() in p9_client_write() on failure, but at this point of the failure copy_from_iter_full (which advanced the iter) wasn't called yet because the format processing happens after allocation... This was changed by Al Viro in 2015 so it's a "fairly old" bug, but it's a bug on 9p side alright - thanks for the cc Now to figure out how to decide if we want to revert or not... I honestly don't have any bright idea, but I don't know the iov API well at all -- perhaps it's possible to copy without advancing and only advance the iov if IO worked? -- Dominique Martinet | Asmadeus
