From: Zi Yan <ziy@nvidia.com>
To: Zhang Yi <yi.zhang@huaweicloud.com>
Cc: linux-mm@kvack.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, willy@infradead.org,
akpm@linux-foundation.org, wangkefeng.wang@huawei.com,
yangerkun@huawei.com
Subject: Re: [PATCH] mm/truncate: fix out-of-bounds when doing a right-aligned split
Date: Mon, 12 May 2025 09:00:42 -0400 [thread overview]
Message-ID: <D62F0A65-74B0-4607-B1B2-DE4AC61B1AD6@nvidia.com> (raw)
In-Reply-To: <20250512062825.3533342-1-yi.zhang@huaweicloud.com>
On 12 May 2025, at 2:28, Zhang Yi wrote:
> From: Zhang Yi <yi.zhang@huawei.com>
>
> When performing a right split on a folio, the split_at2 may point to a
> not-present page if the offset + length equals the original folio size,
> which will trigger the following error:
>
> BUG: unable to handle page fault for address: ffffea0006000008
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 143ffb9067 P4D 143ffb9067 PUD 143ffb8067 PMD 0
> Oops: Oops: 0000 [#1] SMP PTI
> CPU: 0 UID: 0 PID: 502640 Comm: fsx Not tainted 6.15.0-rc3-gc6156189fc6b #889 PR
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/4
> RIP: 0010:truncate_inode_partial_folio+0x208/0x620
> Code: ff 03 48 01 da e8 78 7e 13 00 48 83 05 10 b5 5a 0c 01 85 c0 0f 85 1c 02 001
> RSP: 0018:ffffc90005bafab0 EFLAGS: 00010286
> RAX: 0000000000000000 RBX: ffffea0005ffff00 RCX: 0000000000000002
> RDX: 000000000000000c RSI: 0000000000013975 RDI: ffffc90005bafa30
> RBP: ffffea0006000000 R08: 0000000000000000 R09: 00000000000009bf
> R10: 00000000000007e0 R11: 0000000000000000 R12: 0000000000001633
> R13: 0000000000000000 R14: ffffea0005ffff00 R15: fffffffffffffffe
> FS: 00007f9f9a161740(0000) GS:ffff8894971fd000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffea0006000008 CR3: 000000017c2ae000 CR4: 00000000000006f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> truncate_inode_pages_range+0x226/0x720
> truncate_pagecache+0x57/0x90
> ...
>
> Fix this issue by skipping the split if truncation aligns with the folio
> size, make sure the split page number lies within the folio.
>
> Fixes: 7460b470a131 ("mm/truncate: use folio_split() in truncate operation")
> Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
> ---
> mm/truncate.c | 20 ++++++++++++--------
> 1 file changed, 12 insertions(+), 8 deletions(-)
>
LGTM. Thank you for fixing it. Reviewed-by: Zi Yan <ziy@nvidia.com>
--
Best Regards,
Yan, Zi
prev parent reply other threads:[~2025-05-12 13:00 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-12 6:28 Zhang Yi
2025-05-12 13:00 ` Zi Yan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=D62F0A65-74B0-4607-B1B2-DE4AC61B1AD6@nvidia.com \
--to=ziy@nvidia.com \
--cc=akpm@linux-foundation.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=wangkefeng.wang@huawei.com \
--cc=willy@infradead.org \
--cc=yangerkun@huawei.com \
--cc=yi.zhang@huaweicloud.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox