In the Linux kernel, the following vulnerability has been resolved: mm, thp: bail out early in collapsefile for writeback page Currently collapsefile does not explicitly check PGwriteback, instead, pagehasprivate and trytoreleasepage are used to filter writeback pages. This does not work for xfs with blocksize equal to or larger than pagesize, because in such case xfs has no page->private. This makes collapsefile bail out early for writeback page. Otherwise, xfs endpagewriteback will panic as follows. page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:ffff0003f88c86a8 index:0x0 pfn:0x84ef32 aops:xfsaddressspaceoperations [xfs] ino:30000b7 dentry name:"libtest.so" flags: 0x57fffe0000008027(locked|referenced|uptodate|active|writeback) raw: 57fffe0000008027 ffff80001b48bc28 ffff80001b48bc28 ffff0003f88c86a8 raw: 0000000000000000 0000000000000000 00000000ffffffff ffff0000c3e9a000 page dumped because: VMBUGONPAGE(((unsigned int) pagerefcount(page) + 127u <= 127u)) page->memcgroup:ffff0000c3e9a000 ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:1212! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: BUG: Bad page state in process khugepaged pfn:84ef32 xfs(E) page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:0 index:0x0 pfn:0x84ef32 libcrc32c(E) rfkill(E) aesceblk(E) cryptosimd(E) ... CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Tainted: ... pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) Call trace: endpagewriteback+0x1c0/0x214 iomapfinishpagewriteback+0x13c/0x204 iomapfinishioend+0xe8/0x19c iomapwritepageendbio+0x38/0x50 bioendio+0x168/0x1ec blkupdaterequest+0x278/0x3f0 blkmqendrequest+0x34/0x15c virtblkrequestdone+0x38/0x74 [virtioblk] blkdonesoftirq+0xc4/0x110 _dosoftirq+0x128/0x38c _irqexitrcu+0x118/0x150 irqexit+0x1c/0x30 _handledomainirq+0x8c/0xf0 gichandleirq+0x84/0x108 el1irq+0xcc/0x180 archcpuidle+0x18/0x40 defaultidlecall+0x4c/0x1a0 cpuidleidlecall+0x168/0x1e0 doidle+0xb4/0x104 cpustartupentry+0x30/0x9c secondarystart_kernel+0x104/0x180 Code: d4210000 b0006161 910c8021 94013f4d (d4210000) ---[ end trace 4a88c6a074082f8c ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt