Re: [syzbot] [mm?] kernel BUG in const_folio_flags (2)
From: Hillf Danton
Date: Thu Nov 28 2024 - 08:04:13 EST
On Thu, 28 Nov 2024 13:23:15 +0100 David Hildenbrand <david@xxxxxxxxxx>
>
> Ah, now I get it; at the point int time we check it actually isn't in
> the pagecache anymore. We perform a folio_test_locked() check before the
> folio_try_get(), which is wrong as the folio can get freed+reallocated
> in the meantime.
>
> The easy fix would be:
#syz test
--- x/mm/filemap.c
+++ y/mm/filemap.c
@@ -3502,10 +3502,10 @@ static struct folio *next_uptodate_folio
continue;
if (xa_is_value(folio))
continue;
- if (folio_test_locked(folio))
- continue;
if (!folio_try_get(folio))
continue;
+ if (folio_test_locked(folio))
+ goto skip;
/* Has the page moved or been split? */
if (unlikely(folio != xas_reload(xas)))
goto skip;
--