[PATCH] block: reject bs > ps block devices when THP is disabled

[PATCH] block: reject bs > ps block devices when THP is disabled

[Pankaj Raghav]

If THP is disabled and when a block device with logical block size >
page size is present, the following null ptr deref panic happens during
boot:

[   [13.2 mK  AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07]
[   13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380
<snip>
[   13.025448] Call Trace:
[   13.025692]  <TASK>
[   13.025895]  block_read_full_folio+0x610/0x780
[   13.026379]  ? __pfx_blkdev_get_block+0x10/0x10
[   13.027008]  ? __folio_batch_add_and_move+0x1fa/0x2b0
[   13.027548]  ? __pfx_blkdev_read_folio+0x10/0x10
[   13.028080]  filemap_read_folio+0x9b/0x200
[   13.028526]  ? __pfx_filemap_read_folio+0x10/0x10
[   13.029030]  ? __filemap_get_folio+0x43/0x620
[   13.029497]  do_read_cache_folio+0x155/0x3b0
[   13.029962]  ? __pfx_blkdev_read_folio+0x10/0x10
[   13.030381]  read_part_sector+0xb7/0x2a0
[   13.030805]  read_lba+0x174/0x2c0
<snip>
[   13.045348]  nvme_scan_ns+0x684/0x850 [nvme_core]
[   13.045858]  ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core]
[   13.046414]  ? _raw_spin_unlock+0x15/0x40
[   13.046843]  ? __switch_to+0x523/0x10a0
[   13.047253]  ? kvm_clock_get_cycles+0x14/0x30
[   13.047742]  ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core]
[   13.048353]  async_run_entry_fn+0x96/0x4f0
[   13.048787]  process_one_work+0x667/0x10a0
[   13.049219]  worker_thread+0x63c/0xf60

As large folio support depends on THP, only allow bs > ps block devices
if THP is enabled.

Fixes: 47dd67532303 ("block/bdev: lift block size restrictions to 64k")
Signed-off-by: Pankaj Raghav <p.raghav@samsung.com>
---
 include/linux/blkdev.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 82348fcc2455..724ddc40f35c 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -270,11 +270,16 @@ static inline dev_t disk_devt(struct gendisk *disk)
 	return MKDEV(disk->major, disk->first_minor);
 }
 
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
 /*
  * We should strive for 1 << (PAGE_SHIFT + MAX_PAGECACHE_ORDER)
  * however we constrain this to what we can validate and test.
  */
 #define BLK_MAX_BLOCK_SIZE      SZ_64K
+#else
+#define BLK_MAX_BLOCK_SIZE      PAGE_SIZE
+#endif
+
 
 /* blk_validate_limits() validates bsize, so drivers don't usually need to */
 static inline int blk_validate_block_size(unsigned long bsize)

base-commit: 8d6c58332c7a8ba025fcfa76888b6c37dbce9633
-- 
2.49.0

Re: [PATCH] block: reject bs > ps block devices when THP is disabled

[Matthew Wilcox]

On Fri, Jul 04, 2025 at 11:21:34AM +0200, Pankaj Raghav wrote:
> As large folio support depends on THP, only allow bs > ps block devices
> if THP is enabled.

I mean, it's a quick fix, so sure.  But really we should remove that
dependency.  Particularly for bs>PS as there's no need for any of the
splitting code.

Re: [PATCH] block: reject bs > ps block devices when THP is disabled

[Pankaj Raghav]

On 7/4/25 14:46, Matthew Wilcox wrote:
> On Fri, Jul 04, 2025 at 11:21:34AM +0200, Pankaj Raghav wrote:
>> As large folio support depends on THP, only allow bs > ps block devices
>> if THP is enabled.
> 
> I mean, it's a quick fix, so sure.  But really we should remove that
> dependency.  Particularly for bs>PS as there's no need for any of the
> splitting code.

Ok, I didn't know that. Let's add this as a stop gap and I will take a look so
that we can remove this dependency.

Thanks.

--
Pankaj

Re: [PATCH] block: reject bs > ps block devices when THP is disabled

[Luis Chamberlain]

On Fri, Jul 04, 2025 at 11:21:34AM +0200, Pankaj Raghav wrote:
> If THP is disabled and when a block device with logical block size >
> page size is present, the following null ptr deref panic happens during
> boot:
> 
> [   [13.2 mK  AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07]
> [   13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380
> <snip>
> [   13.025448] Call Trace:
> [   13.025692]  <TASK>
> [   13.025895]  block_read_full_folio+0x610/0x780
> [   13.026379]  ? __pfx_blkdev_get_block+0x10/0x10
> [   13.027008]  ? __folio_batch_add_and_move+0x1fa/0x2b0
> [   13.027548]  ? __pfx_blkdev_read_folio+0x10/0x10
> [   13.028080]  filemap_read_folio+0x9b/0x200
> [   13.028526]  ? __pfx_filemap_read_folio+0x10/0x10
> [   13.029030]  ? __filemap_get_folio+0x43/0x620
> [   13.029497]  do_read_cache_folio+0x155/0x3b0
> [   13.029962]  ? __pfx_blkdev_read_folio+0x10/0x10
> [   13.030381]  read_part_sector+0xb7/0x2a0
> [   13.030805]  read_lba+0x174/0x2c0
> <snip>
> [   13.045348]  nvme_scan_ns+0x684/0x850 [nvme_core]
> [   13.045858]  ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core]
> [   13.046414]  ? _raw_spin_unlock+0x15/0x40
> [   13.046843]  ? __switch_to+0x523/0x10a0
> [   13.047253]  ? kvm_clock_get_cycles+0x14/0x30
> [   13.047742]  ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core]
> [   13.048353]  async_run_entry_fn+0x96/0x4f0
> [   13.048787]  process_one_work+0x667/0x10a0
> [   13.049219]  worker_thread+0x63c/0xf60
> 
> As large folio support depends on THP, only allow bs > ps block devices
> if THP is enabled.
> 
> Fixes: 47dd67532303 ("block/bdev: lift block size restrictions to 64k")
> Signed-off-by: Pankaj Raghav <p.raghav@samsung.com>

Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>

I guess 0-day and syzbot doesn't test non-THP kernels, or they just
hand't tried a block device with a larger sector size yet. I know LTP
had their code updated to use the new limit so that'll take a while to
propagate.

  Luis

Re: [PATCH] block: reject bs > ps block devices when THP is disabled

[Jens Axboe]

On Fri, 04 Jul 2025 11:21:34 +0200, Pankaj Raghav wrote:
> If THP is disabled and when a block device with logical block size >
> page size is present, the following null ptr deref panic happens during
> boot:
> 
> [   [13.2 mK  AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07]
> [   13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380
> <snip>
> [   13.025448] Call Trace:
> [   13.025692]  <TASK>
> [   13.025895]  block_read_full_folio+0x610/0x780
> [   13.026379]  ? __pfx_blkdev_get_block+0x10/0x10
> [   13.027008]  ? __folio_batch_add_and_move+0x1fa/0x2b0
> [   13.027548]  ? __pfx_blkdev_read_folio+0x10/0x10
> [   13.028080]  filemap_read_folio+0x9b/0x200
> [   13.028526]  ? __pfx_filemap_read_folio+0x10/0x10
> [   13.029030]  ? __filemap_get_folio+0x43/0x620
> [   13.029497]  do_read_cache_folio+0x155/0x3b0
> [   13.029962]  ? __pfx_blkdev_read_folio+0x10/0x10
> [   13.030381]  read_part_sector+0xb7/0x2a0
> [   13.030805]  read_lba+0x174/0x2c0
> <snip>
> [   13.045348]  nvme_scan_ns+0x684/0x850 [nvme_core]
> [   13.045858]  ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core]
> [   13.046414]  ? _raw_spin_unlock+0x15/0x40
> [   13.046843]  ? __switch_to+0x523/0x10a0
> [   13.047253]  ? kvm_clock_get_cycles+0x14/0x30
> [   13.047742]  ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core]
> [   13.048353]  async_run_entry_fn+0x96/0x4f0
> [   13.048787]  process_one_work+0x667/0x10a0
> [   13.049219]  worker_thread+0x63c/0xf60
> 
> [...]

Applied, thanks!

[1/1] block: reject bs > ps block devices when THP is disabled
      commit: 4cdf1bdd45ac78a088773722f009883af30ad318

Best regards,
-- 
Jens Axboe