Re: [PATCH] mm/truncate: fix out-of-bounds when doing a right-aligned split

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 12 May 2025, at 2:28, Zhang Yi wrote:

> From: Zhang Yi <yi.zhang@xxxxxxxxxx>
>
> When performing a right split on a folio, the split_at2 may point to a
> not-present page if the offset + length equals the original folio size,
> which will trigger the following error:
>
>  BUG: unable to handle page fault for address: ffffea0006000008
>  #PF: supervisor read access in kernel mode
>  #PF: error_code(0x0000) - not-present page
>  PGD 143ffb9067 P4D 143ffb9067 PUD 143ffb8067 PMD 0
>  Oops: Oops: 0000 [#1] SMP PTI
>  CPU: 0 UID: 0 PID: 502640 Comm: fsx Not tainted 6.15.0-rc3-gc6156189fc6b #889 PR
>  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/4
>  RIP: 0010:truncate_inode_partial_folio+0x208/0x620
>  Code: ff 03 48 01 da e8 78 7e 13 00 48 83 05 10 b5 5a 0c 01 85 c0 0f 85 1c 02 001
>  RSP: 0018:ffffc90005bafab0 EFLAGS: 00010286
>  RAX: 0000000000000000 RBX: ffffea0005ffff00 RCX: 0000000000000002
>  RDX: 000000000000000c RSI: 0000000000013975 RDI: ffffc90005bafa30
>  RBP: ffffea0006000000 R08: 0000000000000000 R09: 00000000000009bf
>  R10: 00000000000007e0 R11: 0000000000000000 R12: 0000000000001633
>  R13: 0000000000000000 R14: ffffea0005ffff00 R15: fffffffffffffffe
>  FS:  00007f9f9a161740(0000) GS:ffff8894971fd000(0000) knlGS:0000000000000000
>  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  CR2: ffffea0006000008 CR3: 000000017c2ae000 CR4: 00000000000006f0
>  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>  Call Trace:
>   <TASK>
>   truncate_inode_pages_range+0x226/0x720
>   truncate_pagecache+0x57/0x90
>   ...
>
> Fix this issue by skipping the split if truncation aligns with the folio
> size, make sure the split page number lies within the folio.
>
> Fixes: 7460b470a131 ("mm/truncate: use folio_split() in truncate operation")
> Signed-off-by: Zhang Yi <yi.zhang@xxxxxxxxxx>
> ---
>  mm/truncate.c | 20 ++++++++++++--------
>  1 file changed, 12 insertions(+), 8 deletions(-)
>
LGTM. Thank you for fixing it. Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>

--
Best Regards,
Yan, Zi




[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [NTFS 3]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [NTFS 3]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux