On Thu, Jul 4, 2019 at 2:06 PM akpm@linux-foundation.org wrote:

The patch titled Subject: mm/z3fold.c: lock z3fold page before __SetPageMovable() has been added to the -mm tree. Its filename is mm-z3foldc-lock-z3fold-page-before-__setpagemovable.patch

This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-z3foldc-lock-z3fold-page-before-... and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-z3foldc-lock-z3fold-page-before-...

Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated there every 3-4 working days

---

From: Henry Burns henryburns@google.com Subject: mm/z3fold.c: lock z3fold page before __SetPageMovable()

Following zsmalloc.c's example we call trylock_page() and unlock_page(). Also make z3fold_page_migrate() assert that newpage is passed in locked, as per the documentation.

Link: http://lkml.kernel.org/r/20190702005122.41036-1-henryburns@google.com Link: http://lkml.kernel.org/r/20190702233538.52793-1-henryburns@google.com Signed-off-by: Henry Burns henryburns@google.com Suggested-by: Vitaly Wool vitalywool@gmail.com Acked-by: Vitaly Wool vitalywool@gmail.com Acked-by: David Rientjes rientjes@google.com Cc: Shakeel Butt shakeelb@google.com Cc: Vitaly Vul vitaly.vul@sony.com Cc: Mike Rapoport rppt@linux.vnet.ibm.com Cc: Xidong Wang wangxidong_97@163.com Cc: Jonathan Adams jwadams@google.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org

---

mm/z3fold.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/mm/z3fold.c~mm-z3foldc-lock-z3fold-page-before-__setpagemovable +++ a/mm/z3fold.c @@ -924,7 +924,16 @@ retry: set_bit(PAGE_HEADLESS, &page->private); goto headless; }

•   __SetPageMovable(page, pool->inode->i_mapping);
  

•   if (can_sleep) {
  

•           lock_page(page);
  

•           __SetPageMovable(page, pool->inode->i_mapping);
  

•           unlock_page(page);
  

•   } else {
  

•           if (!trylock_page(page)) {
  

Oops, the above should be just trylock_page() without the '!'. Andrew, can you please fix this in-place or do you want a new version to be posted.

•                   __SetPageMovable(page, pool->inode->i_mapping);
  

•                   unlock_page(page);
  

•           }
  

•   }
    z3fold_page_lock(zhdr);
  
  

found: @@ -1331,6 +1340,7 @@ static int z3fold_page_migrate(struct ad

    VM_BUG_ON_PAGE(!PageMovable(page), page);
    VM_BUG_ON_PAGE(!PageIsolated(page), page);

•   VM_BUG_ON_PAGE(!PageLocked(newpage), newpage);
  
    zhdr = page_address(page);
    pool = zhdr_to_pool(zhdr);
  

_

Patches currently in -mm which might be from henryburns@google.com are

mm-z3foldc-lock-z3fold-page-before-__setpagemovable.patch mm-z3fold-fix-z3fold_buddy_slots-use-after-free.patch