[PATCH 6.1.y 0/2] Fix NULL folio dereferences from IS_ERR() checks in 6.1.191

[Elliot Berman]

We hit a kernel oops in 6.1.191 in ext4_mb_regular_allocator(), When
ext4's s_buddy_cache pages are evicted, the next block allocation
dereferences a NULL folio.

$ echo 3 > /proc/sys/vm/drop_caches
$ dd if=/dev/zero of=/mnt/b0 bs=1M count=4 conv=fsync
BUG: kernel NULL pointer dereference, address: 0000000000000000

PGD 5f19067 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 908 Comm: dd Not tainted 6.1.191 #1-NixOS
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
RIP: 0010:ext4_mb_load_buddy_gfp (fs/ext4/mballoc.c:1536 (discriminator 1)) ext4
Call Trace:
 <TASK>
ext4_mb_regular_allocator (fs/ext4/mballoc.c:1641 fs/ext4/mballoc.c:2798) ext4
ext4_mb_new_blocks (fs/ext4/mballoc.c:5793) ext4
 ? ext4_find_extent (fs/ext4/extents.c:925) ext4
ext4_ext_map_blocks (fs/ext4/extents.c:4369) ext4
   ...

The cause is a mismatch in these backports first released in 6.1.191:
    d34e4fd4e73f ("ext4: convert bd_bitmap_page to bd_bitmap_folio")
    862483175d3d ("ext4: convert bd_buddy_page to bd_buddy_folio")

The ext4 mballoc folio conversions were written for v6.4 and later, where
__filemap_get_folio() returns ERR_PTR() on failure. 6.1 does not have 
commit 66dabbb65d67 ("mm: return an ERR_PTR from __filemap_get_folio") and
returns NULL instead. The backports should check for NULL and not IS_ERR.

These came in as dependencies of a3a7d360252c ("ext4: fix e4b bitmap
inconsistency reports"), also new in 6.1.191. We could revert all 3
patches and translate Yongjian's patch from `folio_test_locked(folio)`
-> `PageLocked(page)` instead. I suspect backporting 66dabbb65d67 ("mm:
return an ERR_PTR from __filemap_get_folio") is too heavy for stable,
since it requires updating all callers.

Since the same mistake could exist elsewhere, I ran a Coccinelle script
over the tree to flag similar missed backports. Besides ext4, I found one
more case in ntfs3:
    95b917a14b15 ("ntfs: Do not overwrite uptodate pages")

That one needs a folio allocation failure while reading a compressed
file, so it required crafting a fault injection in __filemap_add_folio to
reproduce. I've fixed this one as well.

Reported-by: Tom Bereknyei <tomberek@xxxxxxxxx>
Signed-off-by: Elliot Berman <elliotjb@xxxxxxxxxxxx>
---
Elliot Berman (2):
      ext4: fix NULL folio dereference in mballoc
      bs/ntfs3: fix NULL folio dereference in ntfs_lock_new_page()

 fs/ext4/mballoc.c  | 28 ++++++++++++++--------------
 fs/ntfs3/frecord.c |  4 ++--
 2 files changed, 16 insertions(+), 16 deletions(-)
---
base-commit: 08889840163ebcdb7e24bf7ec311bc2e6fc3aaea
change-id: 20261101-ext4-ntfs3-null-folio-23da60d4940e

Best regards,
--  
Elliot Berman <elliotjb@xxxxxxxxxxxx>