Re: [PATCH v2 2/2] dax/bus: fix Device DAX range alignment validation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] dax: TOCTOU race in size_store causes partial shrink failure
--

commit 519db297333e73581e0bbd5524e7d6959d7610a7
Author: Muchun Song <muchun.song@linux.dev>

    dax/bus: fix Device DAX range alignment validation
    
    dev_dax->align describes the page size used by a Device DAX mapping.
    Both the start and size of every range must therefore be aligned to it;
    otherwise the starting PFN cannot represent a naturally aligned page of
    that size.

> diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
> index e40c25401cf06..277c3ce23b831 100644
> --- a/drivers/dax/bus.c
> +++ b/drivers/dax/bus.c
[ ... ]
> @@ -923,6 +964,9 @@ static int adjust_dev_dax_range(struct dev_dax *dev_dax, struct resource *res, r
>  	if (dev_WARN_ONCE(dev, !size, "deletion is handled by dev_dax_shrink\n"))
>  		return -EINVAL;
>  
> +	if (!range_is_aligned(dev_dax, range->start, size))
> +		return -EINVAL;
> +

[Severity: Medium]
Does this new strict alignment check introduce a regression where partial
shrink fails if the device alignment changes concurrently?

In the sysfs interface, size_store validates the size alignment before
acquiring dax_region_rwsem. If a root user concurrently writes to align_store
and changes the alignment requirement under lock, the shrink path proceeds
with an outdated alignment assumption.

During a shrink, dev_dax_shrink irreversibly deletes fully trailing ranges by
calling trim_dev_dax_range. When it reaches the final range to be partially
shrunk, it calls adjust_dev_dax_range.

If the concurrently updated alignment causes this new range_is_aligned check
to fail, it returns an error mid-operation after trailing ranges have already
been deleted.

Since sysfs writes require root privileges, can this time-of-check to
time-of-use race leave the local resource state corrupted, with the device
configuration permanently broken due to missing ranges and an inconsistent
size?

>  	rc = adjust_resource(res, range->start, size);
>  	if (rc)
>  		return rc;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922082551.874901-1-songmuchun@bytedance.com?part=2