Re: [PATCH] btrfs: raid56: fix a out-of-boundary access for sub-page systems

[Qu Wenruo <wqu@suse.com>]

在 2025/11/14 08:09, Qu Wenruo 写道:
> [BUG]
> There is a bug report from IBM that on Power11 the test case btrfs/023
> crashed.
> 
> The call trace itself is not useful as this particular case is a wild
> memory write, which corrupted the SLUB system.
> 
> [CAUSE]
> Inside index_stripe_sectors() we will update rbio->stripe_paddrs[] array
> to reflect the latest stripe_pages[].
> 
> We use the physical address of the corresponding page, add an offset
> inside the page to represent the sector.
> 
> However in patch "btrfs: raid56: remove sector_ptr structure", the
> offset is added to the stripe_pages[] array, not the result of
> page_to_phys().
> 
> This makes the stripe_paddrs[] to be hugely incorrect for subpage
> systems.
> 
> [FIX]
> Fix the calculation by adding the offset after page_to_phys().
> 
> Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
> Signed-off-by: Qu Wenruo <wqu@suse.com>
> ---
> The fix will be folded into the offending patch.
> ---
>   fs/btrfs/raid56.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
> index ad3d5e789158..7cb756ac19ba 100644
> --- a/fs/btrfs/raid56.c
> +++ b/fs/btrfs/raid56.c
> @@ -331,8 +331,8 @@ static void index_stripe_sectors(struct btrfs_raid_bio *rbio)
>   		if (!rbio->stripe_pages[page_index])
>   			continue;
>   
> -		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index] +
> -						      offset_in_page(offset));
> +		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index]) +
> +						      offset_in_page(offset);

The folded version will have one less indent, so that offset_in_page() 
is having the same indent at page_to_phys().

Thanks,
Qu

>   	}
>   }
>