Re: [PATCH] btrfs: raid56: fix a out-of-boundary access for sub-page systems

[Venkat Rao Bagalkote <venkat88@linux.ibm.com>]

On 14/11/25 3:09 am, Qu Wenruo wrote:
> [BUG]
> There is a bug report from IBM that on Power11 the test case btrfs/023
> crashed.
>
> The call trace itself is not useful as this particular case is a wild
> memory write, which corrupted the SLUB system.
>
> [CAUSE]
> Inside index_stripe_sectors() we will update rbio->stripe_paddrs[] array
> to reflect the latest stripe_pages[].
>
> We use the physical address of the corresponding page, add an offset
> inside the page to represent the sector.
>
> However in patch "btrfs: raid56: remove sector_ptr structure", the
> offset is added to the stripe_pages[] array, not the result of
> page_to_phys().
>
> This makes the stripe_paddrs[] to be hugely incorrect for subpage
> systems.
>
> [FIX]
> Fix the calculation by adding the offset after page_to_phys().
>
> Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
> Signed-off-by: Qu Wenruo <wqu@suse.com>


Tested this patch, by applying on top of next-20251113 and this fixes 
the reported issue. Hence,

Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>


Regards,

Venkat.

> ---
> The fix will be folded into the offending patch.
> ---
>   fs/btrfs/raid56.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
> index ad3d5e789158..7cb756ac19ba 100644
> --- a/fs/btrfs/raid56.c
> +++ b/fs/btrfs/raid56.c
> @@ -331,8 +331,8 @@ static void index_stripe_sectors(struct btrfs_raid_bio *rbio)
>   		if (!rbio->stripe_pages[page_index])
>   			continue;
>   
> -		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index] +
> -						      offset_in_page(offset));
> +		rbio->stripe_paddrs[i] = page_to_phys(rbio->stripe_pages[page_index]) +
> +						      offset_in_page(offset);
>   	}
>   }
>