From: Joao Martins <joao.m.martins@oracle.com>
To: Muchun Song <songmuchun@bytedance.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Ritesh Harjani <ritesh.list@gmail.com>,
Muchun Song <muchun.song@linux.dev>,
stable@vger.kernel.org, nvdimm@lists.linux.dev,
Dan Williams <djbw@kernel.org>,
linux-cxl@vger.kernel.org, linux-kernel@vger.kernel.org,
Vishal Verma <vishal.l.verma@intel.com>,
Dave Jiang <dave.jiang@intel.com>,
Alison Schofield <alison.schofield@intel.com>
Subject: Re: [PATCH] dax/pmem: fix unaligned compound devmap initialization
Date: Fri, 16 Oct 2026 11:00:04 +0100 [thread overview]
Message-ID: <31c89da1-6d3f-4a42-b6bb-2b8f8170eed6@oracle.com> (raw)
In-Reply-To: <20261016054914.2601510-1-songmuchun@bytedance.com>
On 16/10/2026 06:49, Muchun Song wrote:
> Static pmem Device DAX namespaces reserve space for namespace metadata before
> the user-visible data range, and may also include padding needed to satisfy the
> Device DAX alignment. __dax_pmem_probe() adjusts the dax_region range to start
> at the
>
> Static pmem Device DAX namespaces reserve space for namespace metadata
> before the user-visible data range, and may also include padding needed
> to satisfy the Device DAX alignment. __dax_pmem_probe() adjusts the
> dax_region range to start at the data range, but the dev_pagemap range
> still starts at the beginning of the namespace.
>
> That is not valid for compound devmap mappings whose memmap is stored in
> system RAM. Compound page initialization requires the start PFN to be
> naturally aligned to the compound page size, because the head and tail
> struct pages are initialized according to that geometry. If the pgmap
> starts before the aligned data range, memmap_init_zone_device() can build
> compound page metadata from an unaligned PFN.
>
> The resulting struct page layout is inconsistent with the Device DAX
> mapping. A later mmap fault can then resolve the user-visible PFN through
> invalid compound page metadata and hit a kernel panic while inserting the
> DAX folio.
>
> Fix this by advancing the pgmap start to the aligned Device DAX data
> range for non-altmap compound mappings. Leave base-page namespaces
> unchanged, and leave the altmap path unchanged because
> memmap_init_zone_device() already skips the altmap reservation itself.
>
> Fixes: 14606001efb4 ("device-dax: compound devmap support")
> Cc: <stable@vger.kernel.org>
> Reported-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
> Closes: https://lore.kernel.org/r/wlrkqqvg.ritesh.list@gmail.com
> Assisted-by: LLM
> Signed-off-by: Muchun Song <songmuchun@bytedance.com>
> ---> drivers/dax/pmem.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
> index bee93066a849..d3a9b85107b0 100644
> --- a/drivers/dax/pmem.c
> +++ b/drivers/dax/pmem.c
> @@ -51,6 +51,13 @@ static struct dev_dax *__dax_pmem_probe(struct device *dev)
> /* adjust the dax_region range to the start of data */
> range = pgmap.range;
> range.start += offset;
> + /*
> + * When the memmap is stored in RAM, exclude metadata and alignment
> + * padding from compound page initialization. Otherwise, the pgmap
> + * may start before the naturally aligned Device DAX data range.
> + */
> + if (!pgmap_altmap(&pgmap) && le32_to_cpu(pfn_sb->align) > PAGE_SIZE)
> + pgmap.range.start = range.start;
Should we need to check here for pgmap.type == MEMORY_DEVICE_GENERIC ?
Considering the dedup is not quite applicable for FSDAX.
next prev parent reply other threads:[~2026-10-16 10:00 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-16 5:49 Muchun Song
2026-10-16 10:00 ` Joao Martins [this message]
2026-10-16 14:06 ` Muchun Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=31c89da1-6d3f-4a42-b6bb-2b8f8170eed6@oracle.com \
--to=joao.m.martins@oracle.com \
--cc=akpm@linux-foundation.org \
--cc=alison.schofield@intel.com \
--cc=dave.jiang@intel.com \
--cc=djbw@kernel.org \
--cc=linux-cxl@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=muchun.song@linux.dev \
--cc=nvdimm@lists.linux.dev \
--cc=ritesh.list@gmail.com \
--cc=songmuchun@bytedance.com \
--cc=stable@vger.kernel.org \
--cc=vishal.l.verma@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®