|
| 1 | +From mboxrd@z Thu Jan 1 00:00:00 1970 |
| 2 | +Received: from foss.arm.com (foss.arm.com [217.140.110.172]) |
| 3 | + by smtp.subspace.kernel.org (Postfix) with ESMTP id BCE6D2FFDD5 |
| 4 | + for <nvdimm@lists.linux.dev>; Wed, 14 Jan 2026 17:49:59 +0000 (UTC) |
| 5 | +Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 |
| 6 | +ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; |
| 7 | + t=1768413001; cv=none; b=mYidLRrJZn5ooS7h+lyKLsbA8/GKL/ZqDOCHo66hKab86eV5cgpwbWPeudpYGPiMp/QhczPxwDzq1J9qP57FU8xy5AmIFwF6cAn6FPN0BzBWxBQUeT/pxDwfOkvh33RigAd/HACiTa+9waLWNn94H1tPpUOn1SUKYcC2anb/EMA= |
| 8 | +ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; |
| 9 | + s=arc-20240116; t=1768413001; c=relaxed/simple; |
| 10 | + bh=/AHMpb4+3MfzIhYBPESp8KGt8HTeUy14LUGKGDaY7Jc=; |
| 11 | + h=Message-ID:Date:MIME-Version:To:Cc:From:Subject:Content-Type; b=nYCvtwNmfNPRI2kMt6FzMOpG8Xv2GrytpiVJh3K4jRBpJFo3NO0icdYoGz0yjvq1G4vQvh/VrhrLhOVAEHdNkuGQz1yL6qHm/9KniwafY98ihbvaadCAZtdiNtjhZ646/irNi48nnwxquGqUkiPk2n9PqYSVLR9VYf60nr/nAOA= |
| 12 | +ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 |
| 13 | +Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com |
| 14 | +Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com |
| 15 | +Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) |
| 16 | + by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 4F3F21515; |
| 17 | + Wed, 14 Jan 2026 09:49:52 -0800 (PST) |
| 18 | +Received: from [10.1.37.132] (unknown [10.1.37.132]) |
| 19 | + by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 0CA253F59E; |
| 20 | + Wed, 14 Jan 2026 09:49:57 -0800 (PST) |
| 21 | +Message-ID: <18af3213-6c46-4611-ba75-da5be5a1c9b0@arm.com> |
| 22 | +Date: Wed, 14 Jan 2026 17:49:30 +0000 |
| 23 | +Precedence: bulk |
| 24 | +X-Mailing-List: nvdimm@lists.linux.dev |
| 25 | +List-Id: <nvdimm.lists.linux.dev> |
| 26 | +List-Subscribe: <mailto:nvdimm+subscribe@lists.linux.dev> |
| 27 | +List-Unsubscribe: <mailto:nvdimm+unsubscribe@lists.linux.dev> |
| 28 | +MIME-Version: 1.0 |
| 29 | +User-Agent: Mozilla Thunderbird |
| 30 | +Content-Language: en-US |
| 31 | +To: linux-kernel@vger.kernel.org |
| 32 | +Cc: linux-fsdevel@vger.kernel.org, nvdimm@lists.linux.dev, |
| 33 | + dan.j.williams@intel.com, willy@infradead.org, jack@suse.cz, |
| 34 | + Nick.Connolly@arm.com, ffidencio@nvidia.com |
| 35 | +From: Seunguk Shin <seunguk.shin@arm.com> |
| 36 | +Subject: [PATCH] fs/dax: check zero or empty entry before converting xarray |
| 37 | +Content-Type: text/plain; charset=UTF-8; format=flowed |
| 38 | +Content-Transfer-Encoding: 8bit |
| 39 | + |
| 40 | +Trying to convert zero or empty xarray entry causes kernel panic. |
| 41 | + |
| 42 | +[ 0.737679] EXT4-fs (pmem0p1): mounted filesystem |
| 43 | +79676804-7c8b-491a-b2a6-9bae3c72af70 ro with ordered data mode. Quota |
| 44 | +mode: disabled. |
| 45 | +[ 0.737891] VFS: Mounted root (ext4 filesystem) readonly on device 259:1. |
| 46 | +[ 0.739119] devtmpfs: mounted |
| 47 | +[ 0.739476] Freeing unused kernel memory: 1920K |
| 48 | +[ 0.740156] Run /sbin/init as init process |
| 49 | +[ 0.740229] with arguments: |
| 50 | +[ 0.740286] /sbin/init |
| 51 | +[ 0.740321] with environment: |
| 52 | +[ 0.740369] HOME=/ |
| 53 | +[ 0.740400] TERM=linux |
| 54 | +[ 0.743162] Unable to handle kernel paging request at virtual address |
| 55 | +fffffdffbf000008 |
| 56 | +[ 0.743285] Mem abort info: |
| 57 | +[ 0.743316] ESR = 0x0000000096000006 |
| 58 | +[ 0.743371] EC = 0x25: DABT (current EL), IL = 32 bits |
| 59 | +[ 0.743444] SET = 0, FnV = 0 |
| 60 | +[ 0.743489] EA = 0, S1PTW = 0 |
| 61 | +[ 0.743545] FSC = 0x06: level 2 translation fault |
| 62 | +[ 0.743610] Data abort info: |
| 63 | +[ 0.743656] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 |
| 64 | +[ 0.743720] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 |
| 65 | +[ 0.743785] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 |
| 66 | +[ 0.743848] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000b9d17000 |
| 67 | +[ 0.743931] [fffffdffbf000008] pgd=10000000bfa3d403, |
| 68 | +p4d=10000000bfa3d403, pud=1000000040bfe403, pmd=0000000000000000 |
| 69 | +[ 0.744070] Internal error: Oops: 0000000096000006 [#1] SMP |
| 70 | +[ 0.748888] CPU: 0 UID: 0 PID: 1 Comm: init Not tainted 6.18.4 #1 NONE |
| 71 | +[ 0.749421] pstate: 004000c5 (nzcv daIF +PAN -UAO -TCO -DIT -SSBS |
| 72 | +BTYPE=--) |
| 73 | +[ 0.749969] pc : dax_disassociate_entry.constprop.0+0x20/0x50 |
| 74 | +[ 0.750444] lr : dax_insert_entry+0xcc/0x408 |
| 75 | +[ 0.750802] sp : ffff80008000b9e0 |
| 76 | +[ 0.751083] x29: ffff80008000b9e0 x28: 0000000000000000 x27: |
| 77 | +0000000000000000 |
| 78 | +[ 0.751682] x26: 0000000001963d01 x25: ffff0000004f7d90 x24: |
| 79 | +0000000000000000 |
| 80 | +[ 0.752264] x23: 0000000000000000 x22: ffff80008000bcc8 x21: |
| 81 | +0000000000000011 |
| 82 | +[ 0.752836] x20: ffff80008000ba90 x19: 0000000001963d01 x18: |
| 83 | +0000000000000000 |
| 84 | +[ 0.753407] x17: 0000000000000000 x16: 0000000000000000 x15: |
| 85 | +0000000000000000 |
| 86 | +[ 0.753970] x14: ffffbf3154b9ae70 x13: 0000000000000000 x12: |
| 87 | +ffffbf3154b9ae70 |
| 88 | +[ 0.754548] x11: ffffffffffffffff x10: 0000000000000000 x9 : |
| 89 | +0000000000000000 |
| 90 | +[ 0.755122] x8 : 000000000000000d x7 : 000000000000001f x6 : |
| 91 | +0000000000000000 |
| 92 | +[ 0.755707] x5 : 0000000000000000 x4 : 0000000000000000 x3 : |
| 93 | +fffffdffc0000000 |
| 94 | +[ 0.756287] x2 : 0000000000000008 x1 : 0000000040000000 x0 : |
| 95 | +fffffdffbf000000 |
| 96 | +[ 0.756871] Call trace: |
| 97 | +[ 0.757107] dax_disassociate_entry.constprop.0+0x20/0x50 (P) |
| 98 | +[ 0.757592] dax_iomap_pte_fault+0x4fc/0x808 |
| 99 | +[ 0.757951] dax_iomap_fault+0x28/0x30 |
| 100 | +[ 0.758258] ext4_dax_huge_fault+0x80/0x2dc |
| 101 | +[ 0.758594] ext4_dax_fault+0x10/0x3c |
| 102 | +[ 0.758892] __do_fault+0x38/0x12c |
| 103 | +[ 0.759175] __handle_mm_fault+0x530/0xcf0 |
| 104 | +[ 0.759518] handle_mm_fault+0xe4/0x230 |
| 105 | +[ 0.759833] do_page_fault+0x17c/0x4dc |
| 106 | +[ 0.760144] do_translation_fault+0x30/0x38 |
| 107 | +[ 0.760483] do_mem_abort+0x40/0x8c |
| 108 | +[ 0.760771] el0_ia+0x4c/0x170 |
| 109 | +[ 0.761032] el0t_64_sync_handler+0xd8/0xdc |
| 110 | +[ 0.761371] el0t_64_sync+0x168/0x16c |
| 111 | +[ 0.761677] Code: f9453021 f2dfbfe3 cb813080 8b001860 (f9400401) |
| 112 | +[ 0.762168] ---[ end trace 0000000000000000 ]--- |
| 113 | +[ 0.762550] note: init[1] exited with irqs disabled |
| 114 | +[ 0.762631] Kernel panic - not syncing: Attempted to kill init! |
| 115 | +exitcode=0x0000000b |
| 116 | + |
| 117 | +This patch just reorders checking and converting. |
| 118 | + |
| 119 | +Signed-off-by: Seunguk Shin <seunguk.shin@arm.com> |
| 120 | +--- |
| 121 | + fs/dax.c | 9 ++++++--- |
| 122 | + 1 file changed, 6 insertions(+), 3 deletions(-) |
| 123 | + |
| 124 | +diff --git a/fs/dax.c b/fs/dax.c |
| 125 | +index 516f995a9..69ac2562c 100644 |
| 126 | +--- a/fs/dax.c |
| 127 | ++++ b/fs/dax.c |
| 128 | +@@ -443,11 +443,12 @@ static void dax_associate_entry(void *entry, struct address_space *mapping, |
| 129 | + unsigned long address, bool shared) |
| 130 | + { |
| 131 | + unsigned long size = dax_entry_size(entry), index; |
| 132 | +- struct folio *folio = dax_to_folio(entry); |
| 133 | ++ struct folio *folio; |
| 134 | + |
| 135 | + if (dax_is_zero_entry(entry) || dax_is_empty_entry(entry)) |
| 136 | + return; |
| 137 | + |
| 138 | ++ folio = dax_to_folio(entry); |
| 139 | + index = linear_page_index(vma, address & ~(size - 1)); |
| 140 | + if (shared && (folio->mapping || dax_folio_is_shared(folio))) { |
| 141 | + if (folio->mapping) |
| 142 | +@@ -468,21 +469,23 @@ static void dax_associate_entry(void *entry, struct address_space *mapping, |
| 143 | + static void dax_disassociate_entry(void *entry, struct address_space *mapping, |
| 144 | + bool trunc) |
| 145 | + { |
| 146 | +- struct folio *folio = dax_to_folio(entry); |
| 147 | ++ struct folio *folio; |
| 148 | + |
| 149 | + if (dax_is_zero_entry(entry) || dax_is_empty_entry(entry)) |
| 150 | + return; |
| 151 | + |
| 152 | ++ folio = dax_to_folio(entry); |
| 153 | + dax_folio_put(folio); |
| 154 | + } |
| 155 | + |
| 156 | + static struct page *dax_busy_page(void *entry) |
| 157 | + { |
| 158 | +- struct folio *folio = dax_to_folio(entry); |
| 159 | ++ struct folio *folio; |
| 160 | + |
| 161 | + if (dax_is_zero_entry(entry) || dax_is_empty_entry(entry)) |
| 162 | + return NULL; |
| 163 | + |
| 164 | ++ folio = dax_to_folio(entry); |
| 165 | + if (folio_ref_count(folio) - folio_mapcount(folio)) |
| 166 | + return &folio->page; |
| 167 | + else |
| 168 | +-- |
| 169 | +2.43.0 |
| 170 | + |
0 commit comments