The patch titled Subject: radix-tree: fix radix_tree_iter_retry() for tagged iterators. has been added to the -mm tree. Its filename is radix-tree-fix-radix_tree_iter_retry-for-tagged-iterators.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/radix-tree-fix-radix_tree_iter_retry-for-tagged-iterators.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/radix-tree-fix-radix_tree_iter_retry-for-tagged-iterators.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx> Subject: radix-tree: fix radix_tree_iter_retry() for tagged iterators. radix_tree_iter_retry() resets slot to NULL, but it doesn't reset tags. Then NULL slot and non-zero iter.tags passed to radix_tree_next_slot() leading to crash: RIP: [< inline >] radix_tree_next_slot include/linux/radix-tree.h:473 [<ffffffff816951a4>] find_get_pages_tag+0x334/0x930 mm/filemap.c:1452 .... Call Trace: [<ffffffff816cd91a>] pagevec_lookup_tag+0x3a/0x80 mm/swap.c:960 [<ffffffff81ab4231>] mpage_prepare_extent_to_map+0x321/0xa90 fs/ext4/inode.c:2516 [<ffffffff81ac883e>] ext4_writepages+0x10be/0x2b20 fs/ext4/inode.c:2736 [<ffffffff816c99c7>] do_writepages+0x97/0x100 mm/page-writeback.c:2364 [<ffffffff8169bee8>] __filemap_fdatawrite_range+0x248/0x2e0 mm/filemap.c:300 [<ffffffff8169c371>] filemap_write_and_wait_range+0x121/0x1b0 mm/filemap.c:490 [<ffffffff81aa584d>] ext4_sync_file+0x34d/0xdb0 fs/ext4/fsync.c:115 [<ffffffff818b667a>] vfs_fsync_range+0x10a/0x250 fs/sync.c:195 [< inline >] vfs_fsync fs/sync.c:209 [<ffffffff818b6832>] do_fsync+0x42/0x70 fs/sync.c:219 [< inline >] SYSC_fdatasync fs/sync.c:232 [<ffffffff818b6f89>] SyS_fdatasync+0x19/0x20 fs/sync.c:230 [<ffffffff86a94e00>] entry_SYSCALL_64_fastpath+0x23/0xc1 arch/x86/entry/entry_64.S:207 We must reset iterator's tags to bail out from radix_tree_next_slot() and go to the slow-path in radix_tree_next_chunk(). Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup") Link: http://lkml.kernel.org/r/1468495196-10604-1-git-send-email-aryabinin@xxxxxxxxxxxxx Signed-off-by: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx> Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx> Acked-by: Konstantin Khlebnikov <koct9i@xxxxxxxxx> Cc: Matthew Wilcox <willy@xxxxxxxxxxxxxxx> Cc: Hugh Dickins <hughd@xxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- include/linux/radix-tree.h | 1 + 1 file changed, 1 insertion(+) diff -puN include/linux/radix-tree.h~radix-tree-fix-radix_tree_iter_retry-for-tagged-iterators include/linux/radix-tree.h --- a/include/linux/radix-tree.h~radix-tree-fix-radix_tree_iter_retry-for-tagged-iterators +++ a/include/linux/radix-tree.h @@ -407,6 +407,7 @@ static inline __must_check void **radix_tree_iter_retry(struct radix_tree_iter *iter) { iter->next_index = iter->index; + iter->tags = 0; return NULL; } _ Patches currently in -mm which might be from aryabinin@xxxxxxxxxxxxx are radix-tree-fix-radix_tree_iter_retry-for-tagged-iterators.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html