From nobody Sun Feb 8 07:14:48 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id BCEEC31B833; Wed, 14 Jan 2026 17:49:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768413002; cv=none; b=KKm3Ochra3P3KmdAAiR7KsQZR/210ANLPkZ4AGcUkXXuiSlctsJZ7MFRJJLVxhg3OEd3IDcsVrnNYFDLXRMQa9bJyG+sP6mnmsGWNaeZkB1eYuO/qIHe7n8Xp6OFRafpbMRFl//pUP/2OI6X9ygtd3rTAs5zWFP+pc17vZNva28= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768413002; c=relaxed/simple; bh=/AHMpb4+3MfzIhYBPESp8KGt8HTeUy14LUGKGDaY7Jc=; h=Message-ID:Date:MIME-Version:To:Cc:From:Subject:Content-Type; b=nBeQrihhaDleCCWuyxeduYxg7evMbIJNgoVClRxJgOX4ITqvz+qSDazmEDESBIVtSuJXNFWHmWB5PixOmVb0iySpyNAEec8BH4EKTlLMwsSdI1GCI5AVhJH2plxUxSvbwQa26OKq9GiHmMpNmXmjz2z/RH1rinWpkb3FNVhXigM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 4F3F21515; Wed, 14 Jan 2026 09:49:52 -0800 (PST) Received: from [10.1.37.132] (unknown [10.1.37.132]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 0CA253F59E; Wed, 14 Jan 2026 09:49:57 -0800 (PST) Message-ID: <18af3213-6c46-4611-ba75-da5be5a1c9b0@arm.com> Date: Wed, 14 Jan 2026 17:49:30 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: linux-kernel@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, nvdimm@lists.linux.dev, dan.j.williams@intel.com, willy@infradead.org, jack@suse.cz, Nick.Connolly@arm.com, ffidencio@nvidia.com From: Seunguk Shin Subject: [PATCH] fs/dax: check zero or empty entry before converting xarray Content-Type: text/plain; charset="utf-8"; format="flowed" Content-Transfer-Encoding: quoted-printable Trying to convert zero or empty xarray entry causes kernel panic. [=C2=A0 =C2=A0 0.737679] EXT4-fs (pmem0p1): mounted filesystem=20 79676804-7c8b-491a-b2a6-9bae3c72af70 ro with ordered data mode. Quota=20 mode: disabled. [=C2=A0 =C2=A0 0.737891] VFS: Mounted root (ext4 filesystem) readonly on de= vice 259:1. [=C2=A0 =C2=A0 0.739119] devtmpfs: mounted [=C2=A0 =C2=A0 0.739476] Freeing unused kernel memory: 1920K [=C2=A0 =C2=A0 0.740156] Run /sbin/init as init process [=C2=A0 =C2=A0 0.740229]=C2=A0 =C2=A0with arguments: [=C2=A0 =C2=A0 0.740286]=C2=A0 =C2=A0 =C2=A0/sbin/init [=C2=A0 =C2=A0 0.740321]=C2=A0 =C2=A0with environment: [=C2=A0 =C2=A0 0.740369]=C2=A0 =C2=A0 =C2=A0HOME=3D/ [=C2=A0 =C2=A0 0.740400]=C2=A0 =C2=A0 =C2=A0TERM=3Dlinux [=C2=A0 =C2=A0 0.743162] Unable to handle kernel paging request at virtual = address=20 fffffdffbf000008 [=C2=A0 =C2=A0 0.743285] Mem abort info: [=C2=A0 =C2=A0 0.743316]=C2=A0 =C2=A0ESR =3D 0x0000000096000006 [=C2=A0 =C2=A0 0.743371]=C2=A0 =C2=A0EC =3D 0x25: DABT (current EL), IL =3D= 32 bits [=C2=A0 =C2=A0 0.743444]=C2=A0 =C2=A0SET =3D 0, FnV =3D 0 [=C2=A0 =C2=A0 0.743489]=C2=A0 =C2=A0EA =3D 0, S1PTW =3D 0 [=C2=A0 =C2=A0 0.743545]=C2=A0 =C2=A0FSC =3D 0x06: level 2 translation fault [=C2=A0 =C2=A0 0.743610] Data abort info: [=C2=A0 =C2=A0 0.743656]=C2=A0 =C2=A0ISV =3D 0, ISS =3D 0x00000006, ISS2 = =3D 0x00000000 [=C2=A0 =C2=A0 0.743720]=C2=A0 =C2=A0CM =3D 0, WnR =3D 0, TnD =3D 0, TagAcc= ess =3D 0 [=C2=A0 =C2=A0 0.743785]=C2=A0 =C2=A0GCS =3D 0, Overlay =3D 0, DirtyBit =3D= 0, Xs =3D 0 [=C2=A0 =C2=A0 0.743848] swapper pgtable: 4k pages, 48-bit VAs, pgdp=3D0000= 0000b9d17000 [=C2=A0 =C2=A0 0.743931] [fffffdffbf000008] pgd=3D10000000bfa3d403,=20 p4d=3D10000000bfa3d403, pud=3D1000000040bfe403, pmd=3D0000000000000000 [=C2=A0 =C2=A0 0.744070] Internal error: Oops: 0000000096000006 [#1]=C2=A0 = SMP [=C2=A0 =C2=A0 0.748888] CPU: 0 UID: 0 PID: 1 Comm: init Not tainted 6.18.4= #1 NONE [=C2=A0 =C2=A0 0.749421] pstate: 004000c5 (nzcv daIF +PAN -UAO -TCO -DIT -S= SBS=20 BTYPE=3D--) [=C2=A0 =C2=A0 0.749969] pc : dax_disassociate_entry.constprop.0+0x20/0x50 [=C2=A0 =C2=A0 0.750444] lr : dax_insert_entry+0xcc/0x408 [=C2=A0 =C2=A0 0.750802] sp : ffff80008000b9e0 [=C2=A0 =C2=A0 0.751083] x29: ffff80008000b9e0 x28: 0000000000000000 x27:=20 0000000000000000 [=C2=A0 =C2=A0 0.751682] x26: 0000000001963d01 x25: ffff0000004f7d90 x24:=20 0000000000000000 [=C2=A0 =C2=A0 0.752264] x23: 0000000000000000 x22: ffff80008000bcc8 x21:=20 0000000000000011 [=C2=A0 =C2=A0 0.752836] x20: ffff80008000ba90 x19: 0000000001963d01 x18:=20 0000000000000000 [=C2=A0 =C2=A0 0.753407] x17: 0000000000000000 x16: 0000000000000000 x15:=20 0000000000000000 [=C2=A0 =C2=A0 0.753970] x14: ffffbf3154b9ae70 x13: 0000000000000000 x12:=20 ffffbf3154b9ae70 [=C2=A0 =C2=A0 0.754548] x11: ffffffffffffffff x10: 0000000000000000 x9 :=20 0000000000000000 [=C2=A0 =C2=A0 0.755122] x8 : 000000000000000d x7 : 000000000000001f x6 :=20 0000000000000000 [=C2=A0 =C2=A0 0.755707] x5 : 0000000000000000 x4 : 0000000000000000 x3 :=20 fffffdffc0000000 [=C2=A0 =C2=A0 0.756287] x2 : 0000000000000008 x1 : 0000000040000000 x0 :=20 fffffdffbf000000 [=C2=A0 =C2=A0 0.756871] Call trace: [=C2=A0 =C2=A0 0.757107]=C2=A0 dax_disassociate_entry.constprop.0+0x20/0x50= (P) [=C2=A0 =C2=A0 0.757592]=C2=A0 dax_iomap_pte_fault+0x4fc/0x808 [=C2=A0 =C2=A0 0.757951]=C2=A0 dax_iomap_fault+0x28/0x30 [=C2=A0 =C2=A0 0.758258]=C2=A0 ext4_dax_huge_fault+0x80/0x2dc [=C2=A0 =C2=A0 0.758594]=C2=A0 ext4_dax_fault+0x10/0x3c [=C2=A0 =C2=A0 0.758892]=C2=A0 __do_fault+0x38/0x12c [=C2=A0 =C2=A0 0.759175]=C2=A0 __handle_mm_fault+0x530/0xcf0 [=C2=A0 =C2=A0 0.759518]=C2=A0 handle_mm_fault+0xe4/0x230 [=C2=A0 =C2=A0 0.759833]=C2=A0 do_page_fault+0x17c/0x4dc [=C2=A0 =C2=A0 0.760144]=C2=A0 do_translation_fault+0x30/0x38 [=C2=A0 =C2=A0 0.760483]=C2=A0 do_mem_abort+0x40/0x8c [=C2=A0 =C2=A0 0.760771]=C2=A0 el0_ia+0x4c/0x170 [=C2=A0 =C2=A0 0.761032]=C2=A0 el0t_64_sync_handler+0xd8/0xdc [=C2=A0 =C2=A0 0.761371]=C2=A0 el0t_64_sync+0x168/0x16c [=C2=A0 =C2=A0 0.761677] Code: f9453021 f2dfbfe3 cb813080 8b001860 (f940040= 1) [=C2=A0 =C2=A0 0.762168] ---[ end trace 0000000000000000 ]--- [=C2=A0 =C2=A0 0.762550] note: init[1] exited with irqs disabled [=C2=A0 =C2=A0 0.762631] Kernel panic - not syncing: Attempted to kill init= !=20 exitcode=3D0x0000000b This patch just reorders checking and converting. Signed-off-by: Seunguk Shin Reviewed-by: Alistair Popple Reviewed-by: Jan Kara --- =C2=A0fs/dax.c | 9 ++++++--- =C2=A01 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/dax.c b/fs/dax.c index 289e6254aa30..de316be2cc4e 100644 --- a/fs/dax.c +++ b/fs/dax.c @@ -443,11 +443,12 @@ static void dax_associate_entry(void *entry,=20 struct address_space *mapping, =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 unsigned long address, bool shared) =C2=A0{ =C2=A0 =C2=A0 =C2=A0 =C2=A0 unsigned long size =3D dax_entry_size(entry), = index; -=C2=A0 =C2=A0 =C2=A0 =C2=A0struct folio *folio =3D dax_to_folio(entry); +=C2=A0 =C2=A0 =C2=A0 =C2=A0struct folio *folio; =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (dax_is_zero_entry(entry) || dax_is_empty_e= ntry(entry)) =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 return; +=C2=A0 =C2=A0 =C2=A0 =C2=A0folio =3D dax_to_folio(entry); =C2=A0 =C2=A0 =C2=A0 =C2=A0 index =3D linear_page_index(vma, address & ~(s= ize - 1)); =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (shared && (folio->mapping || dax_folio_is_= shared(folio))) { =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (folio->mapping) @@ -468,21 +469,23 @@ static void dax_associate_entry(void *entry,=20 struct address_space *mapping, =C2=A0static void dax_disassociate_entry(void *entry, struct address_space=20 *mapping, =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 bool trunc) =C2=A0{ -=C2=A0 =C2=A0 =C2=A0 =C2=A0struct folio *folio =3D dax_to_folio(entry); +=C2=A0 =C2=A0 =C2=A0 =C2=A0struct folio *folio; =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (dax_is_zero_entry(entry) || dax_is_empty_e= ntry(entry)) =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 return; +=C2=A0 =C2=A0 =C2=A0 =C2=A0folio =3D dax_to_folio(entry); =C2=A0 =C2=A0 =C2=A0 =C2=A0 dax_folio_put(folio); =C2=A0} =C2=A0static struct page *dax_busy_page(void *entry) =C2=A0{ -=C2=A0 =C2=A0 =C2=A0 =C2=A0struct folio *folio =3D dax_to_folio(entry); +=C2=A0 =C2=A0 =C2=A0 =C2=A0struct folio *folio; =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (dax_is_zero_entry(entry) || dax_is_empty_e= ntry(entry)) =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 return NULL; +=C2=A0 =C2=A0 =C2=A0 =C2=A0folio =3D dax_to_folio(entry); =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (folio_ref_count(folio) - folio_mapcount(fo= lio)) =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 return &folio->pag= e; =C2=A0 =C2=A0 =C2=A0 =C2=A0 else -- 2.34.1