From: "Matthew Wilcox (Oracle)" willy@infradead.org
mainline inclusion from mainline-v5.16-rc1 commit d417b49fff3e2f21043c834841e8623a6098741d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6110W CVE: NA
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
It is not safe to check page->index without holding the page lock. It can be changed if the page is moved between the swap cache and the page cache for a shmem file, for example. There is a VM_BUG_ON below which checks page->index is correct after taking the page lock.
Link: https://lkml.kernel.org/r/20210818144932.940640-1-willy@infradead.org Fixes: 5c211ba29deb ("mm: add and use find_lock_entries") Signed-off-by: Matthew Wilcox (Oracle) willy@infradead.org Reported-by: syzbot+c87be4f669d920c76330@syzkaller.appspotmail.com Cc: Hugh Dickins hughd@google.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Linus Torvalds torvalds@linux-foundation.org Signed-off-by: Ma Wupeng mawupeng1@huawei.com Reviewed-by: tong tiangen tongtiangen@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com Signed-off-by: Jialin Zhang zhangjialin11@huawei.com --- mm/filemap.c | 1 - 1 file changed, 1 deletion(-)
diff --git a/mm/filemap.c b/mm/filemap.c index 98b448d9873f..bf92156150ed 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -1956,7 +1956,6 @@ unsigned find_lock_entries(struct address_space *mapping, pgoff_t start, next_idx = page->index + thp_nr_pages(page); if (page->index < start) goto put; - VM_BUG_ON_PAGE(page->index != xas.xa_index, page); if (page->index + thp_nr_pages(page) - 1 > end) goto put; if (!trylock_page(page))