Re: [PATCH 6.1.y 0/2] Fix NULL folio dereferences from IS_ERR() checks in 6.1.191

From: Kevin Fernandez

Date: Mon Nov 02 2026 - 20:42:42 EST


I hit the same oops on 6.1.191 on my server (x86_64, via
ext4_release_file() -> filemap_flush()) and reproduced it in a VM with
write/sync/drop_caches.

Is the series needed on 6.1.y at all? When it was dropped from
6.1.167-rc1 for this same oops, Yongjian Sun noted that 6.1.y lacks
060913999d7a ("mm: migrate: support poisoned recover from migrate
folio"), which introduced the race fixed by bdc56a9c46b2:
https://lkml.iu.edu/hypermail/linux/kernel/2603.3/05097.html

If so, reverting might be simpler. The two folio conversions and three
prep commits are only in 6.1.191 as Stable-dep-of: bdc56a9c46b2, and
a8d83471c560 fixes one of them, so they could go with it. All seven
revert cleanly. In a QEMU test (minimal x86_64 config, same
reproducer): reverting a8d83471c560, a3a7d360252c, 862483175d3d and
d34e4fd4e73f avoids the oops, while reverting a3a7d360252c alone does
not (the oops is in the conversions); also reverting the prep commits
1c0f0e2b9b69, e6b6cbe9f2fb and e394adafb089 leaves
fs/ext4/mballoc.[ch] identical to v6.1.190.