[PATCH] btrfs: raid56: fix a out-of-boundary access for sub-page systems

[PATCH] btrfs: raid56: fix a out-of-boundary access for sub-page systems

[Qu Wenruo]

[BUG]
There is a bug report from IBM that on Power11 the test case btrfs/023
crashed.

The call trace itself is not useful as this particular case is a wild
memory write, which corrupted the SLUB system.

[CAUSE]
Inside index_stripe_sectors() we will update rbio->stripe_paddrs[] array
to reflect the latest stripe_pages[].

We use the physical address of the corresponding page, add an offset
inside the page to represent the sector.

However in patch "btrfs: raid56: remove sector_ptr structure", the
offset is added to the stripe_pages[] array, not the result of
page_to_phys().

This makes the stripe_paddrs[] to be hugely incorrect for subpage
systems.

[FIX]
Fix the calculation by adding the offset after page_to_phys().

Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
---
The fix will be folded into the offending patch.
---
 fs/btrfs/raid56.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index ad3d5e789158..7cb756ac19ba 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -331,8 +331,8 @@ static void index_stripe_sectors(struct btrfs_raid_bio *rbio)
 		if (!rbio->stripe_pages[page_index])
 			continue;
 
-		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index] +
-						      offset_in_page(offset));
+		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index]) +
+						      offset_in_page(offset);
 	}
 }
 
-- 
2.51.2

Re: [PATCH] btrfs: raid56: fix a out-of-boundary access for sub-page systems

[Qu Wenruo]

在 2025/11/14 08:09, Qu Wenruo 写道:
> [BUG]
> There is a bug report from IBM that on Power11 the test case btrfs/023
> crashed.
> 
> The call trace itself is not useful as this particular case is a wild
> memory write, which corrupted the SLUB system.
> 
> [CAUSE]
> Inside index_stripe_sectors() we will update rbio->stripe_paddrs[] array
> to reflect the latest stripe_pages[].
> 
> We use the physical address of the corresponding page, add an offset
> inside the page to represent the sector.
> 
> However in patch "btrfs: raid56: remove sector_ptr structure", the
> offset is added to the stripe_pages[] array, not the result of
> page_to_phys().
> 
> This makes the stripe_paddrs[] to be hugely incorrect for subpage
> systems.
> 
> [FIX]
> Fix the calculation by adding the offset after page_to_phys().
> 
> Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
> Signed-off-by: Qu Wenruo <wqu@suse.com>
> ---
> The fix will be folded into the offending patch.
> ---
>   fs/btrfs/raid56.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
> index ad3d5e789158..7cb756ac19ba 100644
> --- a/fs/btrfs/raid56.c
> +++ b/fs/btrfs/raid56.c
> @@ -331,8 +331,8 @@ static void index_stripe_sectors(struct btrfs_raid_bio *rbio)
>   		if (!rbio->stripe_pages[page_index])
>   			continue;
>   
> -		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index] +
> -						      offset_in_page(offset));
> +		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index]) +
> +						      offset_in_page(offset);

The folded version will have one less indent, so that offset_in_page() 
is having the same indent at page_to_phys().

Thanks,
Qu

>   	}
>   }
>   

Re: [PATCH] btrfs: raid56: fix a out-of-boundary access for sub-page systems

[Venkat Rao Bagalkote]

On 14/11/25 3:09 am, Qu Wenruo wrote:
> [BUG]
> There is a bug report from IBM that on Power11 the test case btrfs/023
> crashed.
>
> The call trace itself is not useful as this particular case is a wild
> memory write, which corrupted the SLUB system.
>
> [CAUSE]
> Inside index_stripe_sectors() we will update rbio->stripe_paddrs[] array
> to reflect the latest stripe_pages[].
>
> We use the physical address of the corresponding page, add an offset
> inside the page to represent the sector.
>
> However in patch "btrfs: raid56: remove sector_ptr structure", the
> offset is added to the stripe_pages[] array, not the result of
> page_to_phys().
>
> This makes the stripe_paddrs[] to be hugely incorrect for subpage
> systems.
>
> [FIX]
> Fix the calculation by adding the offset after page_to_phys().
>
> Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
> Signed-off-by: Qu Wenruo <wqu@suse.com>


Tested this patch, by applying on top of next-20251113 and this fixes 
the reported issue. Hence,

Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>


Regards,

Venkat.

> ---
> The fix will be folded into the offending patch.
> ---
>   fs/btrfs/raid56.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
> index ad3d5e789158..7cb756ac19ba 100644
> --- a/fs/btrfs/raid56.c
> +++ b/fs/btrfs/raid56.c
> @@ -331,8 +331,8 @@ static void index_stripe_sectors(struct btrfs_raid_bio *rbio)
>   		if (!rbio->stripe_pages[page_index])
>   			continue;
>   
> -		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index] +
> -						      offset_in_page(offset));
> +		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index]) +
> +						      offset_in_page(offset);
>   	}
>   }
>