Patch "radix-tree: fix radix_tree_iter_retry() for tagged iterators." has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

radix-tree: fix radix_tree_iter_retry() for tagged iterators.

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
radix-tree-fix-radix_tree_iter_retry-for-tagged-iterators.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Andrey Ryabinin <[email protected]>
Date: Wed, 20 Jul 2016 15:45:00 -0700
Subject: radix-tree: fix radix_tree_iter_retry() for tagged iterators.

From: Andrey Ryabinin <[email protected]>

commit 3cb9185c67304b2a7ea9be73e7d13df6fb2793a1 upstream.

radix_tree_iter_retry() resets slot to NULL, but it doesn't reset tags. Then NULL slot and non-zero iter.tags passed to radix_tree_next_slot() leading to crash:

  RIP: radix_tree_next_slot include/linux/radix-tree.h:473
    find_get_pages_tag+0x334/0x930 mm/filemap.c:1452
  ....
  Call Trace:
    pagevec_lookup_tag+0x3a/0x80 mm/swap.c:960
    mpage_prepare_extent_to_map+0x321/0xa90 fs/ext4/inode.c:2516
    ext4_writepages+0x10be/0x2b20 fs/ext4/inode.c:2736
    do_writepages+0x97/0x100 mm/page-writeback.c:2364
    __filemap_fdatawrite_range+0x248/0x2e0 mm/filemap.c:300
    filemap_write_and_wait_range+0x121/0x1b0 mm/filemap.c:490
    ext4_sync_file+0x34d/0xdb0 fs/ext4/fsync.c:115
    vfs_fsync_range+0x10a/0x250 fs/sync.c:195
    vfs_fsync fs/sync.c:209
    do_fsync+0x42/0x70 fs/sync.c:219
    SYSC_fdatasync fs/sync.c:232
    SyS_fdatasync+0x19/0x20 fs/sync.c:230
    entry_SYSCALL_64_fastpath+0x23/0xc1 arch/x86/entry/entry_64.S:207

We must reset iterator's tags to bail out from radix_tree_next_slot() and go to the slow-path in radix_tree_next_chunk().

---
 include/linux/radix-tree.h |    1 +
 1 file changed, 1 insertion(+)

@@ -399,6 +399,7 @@ static inline __must_check
 void **radix_tree_iter_retry(struct radix_tree_iter *iter)
 {
 	iter->next_index = iter->index;
+	iter->tags = 0;
 	return NULL;
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/vmlinux.lds-account-for-destructor-sections.patch queue-4.6/radix-tree-fix-radix_tree_iter_retry-for-tagged-iterators.patch queue-4.6/kernel-sysrq-watchdog-sched-core-reset-watchdog-on-all-cpus-while-processing-sysrq-w.patch