* Re: [PATCH 0/8] mm: globalize rest_of_page() macro
From: Jens Axboe @ 2026-03-04 3:35 UTC (permalink / raw)
To: Yury Norov, Sean Christopherson
Cc: Jakub Kicinski, Andrew Morton, David S. Miller,
Michael S. Tsirkin, Theodore Ts'o, Albert Ou, Alexander Duyck,
Alexander Gordeev, Alexander Viro, Alexandra Winter,
Andreas Dilger, Andrew Lunn, Anna Schumaker, Anton Yakovlev,
Arnaldo Carvalho de Melo, Aswin Karuvally, Borislav Petkov,
Carlos Maiolino, Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jani Nikula, Janosch Frank, Jaroslav Kysela,
Joonas Lahtinen, Latchesar Ionkov, Linus Walleij,
Madhavan Srinivasan, Mark Brown, Michael Ellerman, Miklos Szeredi,
Namhyung Kim, Palmer Dabbelt, Paolo Abeni, Paolo Bonzini,
Paul Walmsley, Peter Zijlstra, Rodrigo Vivi, Simona Vetter,
Takashi Iwai, Thomas Gleixner, Trond Myklebust, Tvrtko Ursulin,
Vasily Gorbik, Will Deacon, Yury Norov, Zheng Gu, linux-kernel,
x86, linux-arm-kernel, linuxppc-dev, linux-riscv, kvm, linux-s390,
linux-block, intel-gfx, dri-devel, dm-devel, netdev, linux-spi,
linux-ext4, linux-f2fs-devel, linux-fsdevel, linux-xfs, linux-nfs,
linux-crypto, linux-mm, linux-perf-users, v9fs, virtualization,
linux-sound
In-Reply-To: <aaen2pGs0UeiJqz1@yury>
On 3/3/26 8:32 PM, Yury Norov wrote:
> My motivation is that it helps to simplify constructions like this:
>
> - loff_t cmp_len = min(PAGE_SIZE - offset_in_page(srcoff),
> - PAGE_SIZE - offset_in_page(dstoff));
> + loff_t cmp_len = min(rest_of_page(srcoff), rest_of_page(dstoff));
>
> Or this:
>
> - if (folio_test_highmem(dst_folio) &&
> - chunk > PAGE_SIZE - offset_in_page(dst_off))
> - chunk = PAGE_SIZE - offset_in_page(dst_off);
> - if (folio_test_highmem(src_folio) &&
> - chunk > PAGE_SIZE - offset_in_page(src_off))
> - chunk = PAGE_SIZE - offset_in_page(src_off);
> + if (folio_test_highmem(dst_folio) && chunk > rest_of_page(dst_off))
> + chunk = rest_of_page(dst_off);
> + if (folio_test_highmem(src_folio) && chunk > rest_of_page(src_off))
> + chunk = rest_of_page(src_off);
>
> To a point where I don't have to use my brains to decode them. I agree
> it's an easy math. It's just too bulky to my (and 9p guys too) taste.
The thing is, now I have to go lookup what on earth rest_of_page() does,
whereas PAGE_SIZE - offset_in_page(page) is immediately obvious. It's a
classic case of "oh let's add this helper to simplify things" which
really just makes it worse, because now you have to jump to the
definition of rest_of_page().
IOW, just no.
--
Jens Axboe
^ permalink raw reply
* Re: [PATCH 0/8] mm: globalize rest_of_page() macro
From: Yury Norov @ 2026-03-04 3:32 UTC (permalink / raw)
To: Sean Christopherson
Cc: Jens Axboe, Jakub Kicinski, Andrew Morton, David S. Miller,
Michael S. Tsirkin, Theodore Ts'o, Albert Ou, Alexander Duyck,
Alexander Gordeev, Alexander Viro, Alexandra Winter,
Andreas Dilger, Andrew Lunn, Anna Schumaker, Anton Yakovlev,
Arnaldo Carvalho de Melo, Aswin Karuvally, Borislav Petkov,
Carlos Maiolino, Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jani Nikula, Janosch Frank, Jaroslav Kysela,
Joonas Lahtinen, Latchesar Ionkov, Linus Walleij,
Madhavan Srinivasan, Mark Brown, Michael Ellerman, Miklos Szeredi,
Namhyung Kim, Palmer Dabbelt, Paolo Abeni, Paolo Bonzini,
Paul Walmsley, Peter Zijlstra, Rodrigo Vivi, Simona Vetter,
Takashi Iwai, Thomas Gleixner, Trond Myklebust, Tvrtko Ursulin,
Vasily Gorbik, Will Deacon, Yury Norov, Zheng Gu, linux-kernel,
x86, linux-arm-kernel, linuxppc-dev, linux-riscv, kvm, linux-s390,
linux-block, intel-gfx, dri-devel, dm-devel, netdev, linux-spi,
linux-ext4, linux-f2fs-devel, linux-fsdevel, linux-xfs, linux-nfs,
linux-crypto, linux-mm, linux-perf-users, v9fs, virtualization,
linux-sound
In-Reply-To: <aaedwFwXh9QXS3Ju@google.com>
On Tue, Mar 03, 2026 at 06:49:36PM -0800, Sean Christopherson wrote:
> On Tue, Mar 03, 2026, Jens Axboe wrote:
> > On 3/3/26 7:28 PM, Jakub Kicinski wrote:
> > > On Tue, 3 Mar 2026 20:27:08 -0500 Yury Norov wrote:
> > >> The net/9p networking driver has a handy macro to calculate the
> > >> amount of bytes from a given pointer to the end of page. Move it
> > >> to core/mm, and apply tree-wide. No functional changes intended.
> > >>
> > >> This series was originally introduced as a single patch #07/12 in:
> > >>
> > >> https://lore.kernel.org/all/20260219181407.290201-1-ynorov@nvidia.com/
> > >>
> > >> Split it for better granularity and submit separately.
> > >
> > > I don't get what the motivation is here. Another helper developers
> > > and readers of the code will need to know about just to replace
> > > obvious and easy to comprehend math.
> >
> > I fully agree, I had the same thought reading this.
>
> +1 from KVM-land.
My motivation is that it helps to simplify constructions like this:
- loff_t cmp_len = min(PAGE_SIZE - offset_in_page(srcoff),
- PAGE_SIZE - offset_in_page(dstoff));
+ loff_t cmp_len = min(rest_of_page(srcoff), rest_of_page(dstoff));
Or this:
- if (folio_test_highmem(dst_folio) &&
- chunk > PAGE_SIZE - offset_in_page(dst_off))
- chunk = PAGE_SIZE - offset_in_page(dst_off);
- if (folio_test_highmem(src_folio) &&
- chunk > PAGE_SIZE - offset_in_page(src_off))
- chunk = PAGE_SIZE - offset_in_page(src_off);
+ if (folio_test_highmem(dst_folio) && chunk > rest_of_page(dst_off))
+ chunk = rest_of_page(dst_off);
+ if (folio_test_highmem(src_folio) && chunk > rest_of_page(src_off))
+ chunk = rest_of_page(src_off);
To a point where I don't have to use my brains to decode them. I agree
it's an easy math. It's just too bulky to my (and 9p guys too) taste.
Thanks,
Yury
^ permalink raw reply
* Re: [PATCH 0/8] mm: globalize rest_of_page() macro
From: Sean Christopherson @ 2026-03-04 2:49 UTC (permalink / raw)
To: Jens Axboe
Cc: Jakub Kicinski, Yury Norov, Andrew Morton, David S. Miller,
Michael S. Tsirkin, Theodore Ts'o, Albert Ou, Alexander Duyck,
Alexander Gordeev, Alexander Viro, Alexandra Winter,
Andreas Dilger, Andrew Lunn, Anna Schumaker, Anton Yakovlev,
Arnaldo Carvalho de Melo, Aswin Karuvally, Borislav Petkov,
Carlos Maiolino, Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jani Nikula, Janosch Frank, Jaroslav Kysela,
Joonas Lahtinen, Latchesar Ionkov, Linus Walleij,
Madhavan Srinivasan, Mark Brown, Michael Ellerman, Miklos Szeredi,
Namhyung Kim, Palmer Dabbelt, Paolo Abeni, Paolo Bonzini,
Paul Walmsley, Peter Zijlstra, Rodrigo Vivi, Simona Vetter,
Takashi Iwai, Thomas Gleixner, Trond Myklebust, Tvrtko Ursulin,
Vasily Gorbik, Will Deacon, Yury Norov, Zheng Gu, linux-kernel,
x86, linux-arm-kernel, linuxppc-dev, linux-riscv, kvm, linux-s390,
linux-block, intel-gfx, dri-devel, dm-devel, netdev, linux-spi,
linux-ext4, linux-f2fs-devel, linux-fsdevel, linux-xfs, linux-nfs,
linux-crypto, linux-mm, linux-perf-users, v9fs, virtualization,
linux-sound
In-Reply-To: <f8d86743-6231-414d-a5e8-65e867123fea@kernel.dk>
On Tue, Mar 03, 2026, Jens Axboe wrote:
> On 3/3/26 7:28 PM, Jakub Kicinski wrote:
> > On Tue, 3 Mar 2026 20:27:08 -0500 Yury Norov wrote:
> >> The net/9p networking driver has a handy macro to calculate the
> >> amount of bytes from a given pointer to the end of page. Move it
> >> to core/mm, and apply tree-wide. No functional changes intended.
> >>
> >> This series was originally introduced as a single patch #07/12 in:
> >>
> >> https://lore.kernel.org/all/20260219181407.290201-1-ynorov@nvidia.com/
> >>
> >> Split it for better granularity and submit separately.
> >
> > I don't get what the motivation is here. Another helper developers
> > and readers of the code will need to know about just to replace
> > obvious and easy to comprehend math.
>
> I fully agree, I had the same thought reading this.
+1 from KVM-land.
^ permalink raw reply
* Re: [PATCH 0/8] mm: globalize rest_of_page() macro
From: Jens Axboe @ 2026-03-04 2:42 UTC (permalink / raw)
To: Jakub Kicinski, Yury Norov
Cc: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jani Nikula, Janosch Frank, Jaroslav Kysela,
Joonas Lahtinen, Latchesar Ionkov, Linus Walleij,
Madhavan Srinivasan, Mark Brown, Michael Ellerman, Miklos Szeredi,
Namhyung Kim, Palmer Dabbelt, Paolo Abeni, Paolo Bonzini,
Paul Walmsley, Peter Zijlstra, Rodrigo Vivi, Sean Christopherson,
Simona Vetter, Takashi Iwai, Thomas Gleixner, Trond Myklebust,
Tvrtko Ursulin, Vasily Gorbik, Will Deacon, Yury Norov, Zheng Gu,
linux-kernel, x86, linux-arm-kernel, linuxppc-dev, linux-riscv,
kvm, linux-s390, linux-block, intel-gfx, dri-devel, dm-devel,
netdev, linux-spi, linux-ext4, linux-f2fs-devel, linux-fsdevel,
linux-xfs, linux-nfs, linux-crypto, linux-mm, linux-perf-users,
v9fs, virtualization, linux-sound
In-Reply-To: <20260303182845.250bb2de@kernel.org>
On 3/3/26 7:28 PM, Jakub Kicinski wrote:
> On Tue, 3 Mar 2026 20:27:08 -0500 Yury Norov wrote:
>> The net/9p networking driver has a handy macro to calculate the
>> amount of bytes from a given pointer to the end of page. Move it
>> to core/mm, and apply tree-wide. No functional changes intended.
>>
>> This series was originally introduced as a single patch #07/12 in:
>>
>> https://lore.kernel.org/all/20260219181407.290201-1-ynorov@nvidia.com/
>>
>> Split it for better granularity and submit separately.
>
> I don't get what the motivation is here. Another helper developers
> and readers of the code will need to know about just to replace
> obvious and easy to comprehend math.
I fully agree, I had the same thought reading this.
--
Jens Axboe
^ permalink raw reply
* Re: [PATCH 0/8] mm: globalize rest_of_page() macro
From: Jakub Kicinski @ 2026-03-04 2:28 UTC (permalink / raw)
To: Yury Norov
Cc: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jani Nikula, Janosch Frank, Jaroslav Kysela,
Jens Axboe, Joonas Lahtinen, Latchesar Ionkov, Linus Walleij,
Madhavan Srinivasan, Mark Brown, Michael Ellerman, Miklos Szeredi,
Namhyung Kim, Palmer Dabbelt, Paolo Abeni, Paolo Bonzini,
Paul Walmsley, Peter Zijlstra, Rodrigo Vivi, Sean Christopherson,
Simona Vetter, Takashi Iwai, Thomas Gleixner, Trond Myklebust,
Tvrtko Ursulin, Vasily Gorbik, Will Deacon, Yury Norov, Zheng Gu,
linux-kernel, x86, linux-arm-kernel, linuxppc-dev, linux-riscv,
kvm, linux-s390, linux-block, intel-gfx, dri-devel, dm-devel,
netdev, linux-spi, linux-ext4, linux-f2fs-devel, linux-fsdevel,
linux-xfs, linux-nfs, linux-crypto, linux-mm, linux-perf-users,
v9fs, virtualization, linux-sound
In-Reply-To: <20260304012717.201797-1-ynorov@nvidia.com>
On Tue, 3 Mar 2026 20:27:08 -0500 Yury Norov wrote:
> The net/9p networking driver has a handy macro to calculate the
> amount of bytes from a given pointer to the end of page. Move it
> to core/mm, and apply tree-wide. No functional changes intended.
>
> This series was originally introduced as a single patch #07/12 in:
>
> https://lore.kernel.org/all/20260219181407.290201-1-ynorov@nvidia.com/
>
> Split it for better granularity and submit separately.
I don't get what the motivation is here. Another helper developers
and readers of the code will need to know about just to replace
obvious and easy to comprehend math.
^ permalink raw reply
* [PATCH 8/8] arch: use rest_of_page() macro where appropriate
From: Yury Norov @ 2026-03-04 1:27 UTC (permalink / raw)
To: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jakub Kicinski, Jani Nikula, Janosch Frank,
Jaroslav Kysela, Jens Axboe, Joonas Lahtinen, Latchesar Ionkov,
Linus Walleij, Madhavan Srinivasan, Mark Brown, Michael Ellerman,
Miklos Szeredi, Namhyung Kim, Palmer Dabbelt, Paolo Abeni,
Paolo Bonzini, Paul Walmsley, Peter Zijlstra, Rodrigo Vivi,
Sean Christopherson, Simona Vetter, Takashi Iwai, Thomas Gleixner,
Trond Myklebust, Tvrtko Ursulin, Vasily Gorbik, Will Deacon,
Yury Norov, Zheng Gu
Cc: Yury Norov, linux-kernel, x86, linux-arm-kernel, linuxppc-dev,
linux-riscv, kvm, linux-s390, linux-block, intel-gfx, dri-devel,
dm-devel, netdev, linux-spi, linux-ext4, linux-f2fs-devel,
linux-fsdevel, linux-xfs, linux-nfs, linux-crypto, linux-mm,
linux-perf-users, v9fs, virtualization, linux-sound
In-Reply-To: <20260304012717.201797-1-ynorov@nvidia.com>
Switch arch code to using the macro. No functional changes intended.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
arch/arm64/kernel/patching.c | 4 +---
arch/powerpc/lib/code-patching.c | 6 +++---
arch/riscv/kernel/sbi.c | 4 ++--
3 files changed, 6 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/kernel/patching.c b/arch/arm64/kernel/patching.c
index 1041bc67a3ee..4c3a4401719b 100644
--- a/arch/arm64/kernel/patching.c
+++ b/arch/arm64/kernel/patching.c
@@ -116,9 +116,7 @@ static void *__text_poke(text_poke_f func, void *addr, void *src, size_t len)
while (patched < len) {
ptr = addr + patched;
- size = min_t(size_t, PAGE_SIZE - offset_in_page(ptr),
- len - patched);
-
+ size = min_t(size_t, rest_of_page(ptr), len - patched);
waddr = patch_map(ptr, FIX_TEXT_POKE0);
func(waddr, src, patched, size);
patch_unmap(FIX_TEXT_POKE0);
diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
index f84e0337cc02..186a9cb79ee3 100644
--- a/arch/powerpc/lib/code-patching.c
+++ b/arch/powerpc/lib/code-patching.c
@@ -463,7 +463,7 @@ static int __patch_instructions(u32 *patch_addr, u32 *code, size_t len, bool rep
/*
* A page is mapped and instructions that fit the page are patched.
- * Assumes 'len' to be (PAGE_SIZE - offset_in_page(addr)) or below.
+ * Assumes 'len' to be rest_of_page(addr) or below.
*/
static int __do_patch_instructions_mm(u32 *addr, u32 *code, size_t len, bool repeat_instr)
{
@@ -514,7 +514,7 @@ static int __do_patch_instructions_mm(u32 *addr, u32 *code, size_t len, bool rep
/*
* A page is mapped and instructions that fit the page are patched.
- * Assumes 'len' to be (PAGE_SIZE - offset_in_page(addr)) or below.
+ * Assumes 'len' to be rest_of_page(addr) or below.
*/
static int __do_patch_instructions(u32 *addr, u32 *code, size_t len, bool repeat_instr)
{
@@ -554,7 +554,7 @@ int patch_instructions(u32 *addr, u32 *code, size_t len, bool repeat_instr)
size_t plen;
int err;
- plen = min_t(size_t, PAGE_SIZE - offset_in_page(addr), len);
+ plen = min_t(size_t, rest_of_page(addr), len);
local_irq_save(flags);
if (mm_patch_enabled())
diff --git a/arch/riscv/kernel/sbi.c b/arch/riscv/kernel/sbi.c
index c443337056ab..9a2f656f776f 100644
--- a/arch/riscv/kernel/sbi.c
+++ b/arch/riscv/kernel/sbi.c
@@ -602,7 +602,7 @@ int sbi_debug_console_write(const char *bytes, unsigned int num_bytes)
else
base_addr = __pa(bytes);
if (PAGE_SIZE < (offset_in_page(bytes) + num_bytes))
- num_bytes = PAGE_SIZE - offset_in_page(bytes);
+ num_bytes = rest_of_page(bytes);
if (IS_ENABLED(CONFIG_32BIT))
ret = sbi_ecall(SBI_EXT_DBCN, SBI_EXT_DBCN_CONSOLE_WRITE,
@@ -631,7 +631,7 @@ int sbi_debug_console_read(char *bytes, unsigned int num_bytes)
else
base_addr = __pa(bytes);
if (PAGE_SIZE < (offset_in_page(bytes) + num_bytes))
- num_bytes = PAGE_SIZE - offset_in_page(bytes);
+ num_bytes = rest_of_page(bytes);
if (IS_ENABLED(CONFIG_32BIT))
ret = sbi_ecall(SBI_EXT_DBCN, SBI_EXT_DBCN_CONSOLE_READ,
--
2.43.0
^ permalink raw reply related
* [PATCH 7/8] drivers: ALSA: use rest_of_page() macro where appropriate
From: Yury Norov @ 2026-03-04 1:27 UTC (permalink / raw)
To: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jakub Kicinski, Jani Nikula, Janosch Frank,
Jaroslav Kysela, Jens Axboe, Joonas Lahtinen, Latchesar Ionkov,
Linus Walleij, Madhavan Srinivasan, Mark Brown, Michael Ellerman,
Miklos Szeredi, Namhyung Kim, Palmer Dabbelt, Paolo Abeni,
Paolo Bonzini, Paul Walmsley, Peter Zijlstra, Rodrigo Vivi,
Sean Christopherson, Simona Vetter, Takashi Iwai, Thomas Gleixner,
Trond Myklebust, Tvrtko Ursulin, Vasily Gorbik, Will Deacon,
Yury Norov, Zheng Gu
Cc: Yury Norov, linux-kernel, x86, linux-arm-kernel, linuxppc-dev,
linux-riscv, kvm, linux-s390, linux-block, intel-gfx, dri-devel,
dm-devel, netdev, linux-spi, linux-ext4, linux-f2fs-devel,
linux-fsdevel, linux-xfs, linux-nfs, linux-crypto, linux-mm,
linux-perf-users, v9fs, virtualization, linux-sound
In-Reply-To: <20260304012717.201797-1-ynorov@nvidia.com>
Switch drivers to using the macro. No functional changes intended.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
drivers/block/null_blk/main.c | 6 ++----
drivers/gpu/drm/i915/gt/shmem_utils.c | 5 ++---
drivers/md/dm-pcache/backing_dev.h | 2 +-
sound/virtio/virtio_pcm_msg.c | 4 ++--
4 files changed, 7 insertions(+), 10 deletions(-)
diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index f8c0fd57e041..89e9651b09a9 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1147,8 +1147,7 @@ static blk_status_t copy_to_nullb(struct nullb *nullb, void *source,
sector_t sector;
while (count < n) {
- temp = min3(nullb->dev->blocksize, n - count,
- PAGE_SIZE - offset_in_page(pos));
+ temp = min3(nullb->dev->blocksize, n - count, rest_of_page(pos));
sector = pos >> SECTOR_SHIFT;
if (null_cache_active(nullb) && !is_fua)
@@ -1181,8 +1180,7 @@ static void copy_from_nullb(struct nullb *nullb, void *dest, loff_t pos,
sector_t sector;
while (count < n) {
- temp = min3(nullb->dev->blocksize, n - count,
- PAGE_SIZE - offset_in_page(pos));
+ temp = min3(nullb->dev->blocksize, n - count, rest_of_page(pos));
sector = pos >> SECTOR_SHIFT;
t_page = null_lookup_page(nullb, sector, false,
diff --git a/drivers/gpu/drm/i915/gt/shmem_utils.c b/drivers/gpu/drm/i915/gt/shmem_utils.c
index 5850adaebf82..9a0a6f67fef0 100644
--- a/drivers/gpu/drm/i915/gt/shmem_utils.c
+++ b/drivers/gpu/drm/i915/gt/shmem_utils.c
@@ -99,8 +99,7 @@ static int __shmem_rw(struct file *file, loff_t off,
unsigned long pfn;
for (pfn = off >> PAGE_SHIFT; len; pfn++) {
- unsigned int this =
- min_t(size_t, PAGE_SIZE - offset_in_page(off), len);
+ unsigned int this = min_t(size_t, rest_of_page(off), len);
struct page *page;
void *vaddr;
@@ -135,7 +134,7 @@ int shmem_read_to_iosys_map(struct file *file, loff_t off,
for (pfn = off >> PAGE_SHIFT; len; pfn++) {
unsigned int this =
- min_t(size_t, PAGE_SIZE - offset_in_page(off), len);
+ min_t(size_t, rest_of_page(off), len);
struct page *page;
void *vaddr;
diff --git a/drivers/md/dm-pcache/backing_dev.h b/drivers/md/dm-pcache/backing_dev.h
index b371cba483b9..17e83b38b845 100644
--- a/drivers/md/dm-pcache/backing_dev.h
+++ b/drivers/md/dm-pcache/backing_dev.h
@@ -96,7 +96,7 @@ static inline u32 backing_dev_req_coalesced_max_len(const void *data, u32 len)
first_page = vmalloc_to_page(p);
advance:
- in_page = PAGE_SIZE - offset_in_page(p);
+ in_page = rest_of_page(p);
to_advance = min_t(u32, in_page, len - done);
done += to_advance;
diff --git a/sound/virtio/virtio_pcm_msg.c b/sound/virtio/virtio_pcm_msg.c
index a5c4e7027717..5d1b0dc08234 100644
--- a/sound/virtio/virtio_pcm_msg.c
+++ b/sound/virtio/virtio_pcm_msg.c
@@ -56,7 +56,7 @@ static int virtsnd_pcm_sg_num(u8 *data, unsigned int length)
phys_addr_t pg_address = page_to_phys(pg);
size_t pg_length;
- pg_length = PAGE_SIZE - offset_in_page(data);
+ pg_length = rest_of_page(data);
if (pg_length > length)
pg_length = length;
@@ -96,7 +96,7 @@ static void virtsnd_pcm_sg_from(struct scatterlist *sgs, int nsgs, u8 *data,
struct page *pg = vmalloc_to_page(data);
size_t pg_length;
- pg_length = PAGE_SIZE - offset_in_page(data);
+ pg_length = rest_of_page(data);
if (pg_length > length)
pg_length = length;
--
2.43.0
^ permalink raw reply related
* [PATCH 6/8] KVM: use rest_of_page() macro where appropriate
From: Yury Norov @ 2026-03-04 1:27 UTC (permalink / raw)
To: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jakub Kicinski, Jani Nikula, Janosch Frank,
Jaroslav Kysela, Jens Axboe, Joonas Lahtinen, Latchesar Ionkov,
Linus Walleij, Madhavan Srinivasan, Mark Brown, Michael Ellerman,
Miklos Szeredi, Namhyung Kim, Palmer Dabbelt, Paolo Abeni,
Paolo Bonzini, Paul Walmsley, Peter Zijlstra, Rodrigo Vivi,
Sean Christopherson, Simona Vetter, Takashi Iwai, Thomas Gleixner,
Trond Myklebust, Tvrtko Ursulin, Vasily Gorbik, Will Deacon,
Yury Norov, Zheng Gu
Cc: Yury Norov, linux-kernel, x86, linux-arm-kernel, linuxppc-dev,
linux-riscv, kvm, linux-s390, linux-block, intel-gfx, dri-devel,
dm-devel, netdev, linux-spi, linux-ext4, linux-f2fs-devel,
linux-fsdevel, linux-xfs, linux-nfs, linux-crypto, linux-mm,
linux-perf-users, v9fs, virtualization, linux-sound
In-Reply-To: <20260304012717.201797-1-ynorov@nvidia.com>
Switch KVM code to using the macro. No functional changes intended.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
arch/s390/kvm/gaccess.c | 6 +++---
arch/x86/kvm/emulate.c | 4 ++--
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
index 4630b2a067ea..40f85b7eca63 100644
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -973,7 +973,7 @@ int access_guest_with_key(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,
if (rc)
goto out_unlock;
for (idx = 0; idx < nr_pages; idx++) {
- fragment_len = min(PAGE_SIZE - offset_in_page(gpas[idx]), len);
+ fragment_len = min(rest_of_page(gpas[idx]), len);
if (try_fetch_prot_override && fetch_prot_override_applies(ga, fragment_len)) {
rc = access_guest_page_gpa(vcpu->kvm, mode, gpas[idx], data, fragment_len);
} else {
@@ -1015,7 +1015,7 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,
while (len && !rc) {
gpa = kvm_s390_real_to_abs(vcpu, gra);
- fragment_len = min(PAGE_SIZE - offset_in_page(gpa), len);
+ fragment_len = min(rest_of_page(gpa), len);
rc = access_guest_page_gpa(vcpu->kvm, mode, gpa, data, fragment_len);
len -= fragment_len;
gra += fragment_len;
@@ -1237,7 +1237,7 @@ int check_gpa_range(struct kvm *kvm, unsigned long gpa, unsigned long length,
int rc = 0;
while (length && !rc) {
- fragment_len = min(PAGE_SIZE - offset_in_page(gpa), length);
+ fragment_len = min(rest_of_page(gpa), length);
rc = vm_check_access_key_gpa(kvm, access_key, mode, gpa);
length -= fragment_len;
gpa += fragment_len;
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index c8e292e9a24d..c060d1e2bb94 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -864,7 +864,7 @@ static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size)
return rc;
size = min_t(unsigned, 15UL ^ cur_size, max_size);
- size = min_t(unsigned, size, PAGE_SIZE - offset_in_page(linear));
+ size = min_t(unsigned int, size, rest_of_page(linear));
/*
* One instruction can only straddle two pages,
@@ -1372,7 +1372,7 @@ static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) : 1;
in_page = (ctxt->eflags & X86_EFLAGS_DF) ?
offset_in_page(reg_read(ctxt, VCPU_REGS_RDI)) :
- PAGE_SIZE - offset_in_page(reg_read(ctxt, VCPU_REGS_RDI));
+ rest_of_page(reg_read(ctxt, VCPU_REGS_RDI));
n = min3(in_page, (unsigned int)sizeof(rc->data) / size, count);
if (n == 0)
n = 1;
--
2.43.0
^ permalink raw reply related
* [PATCH 5/8] spi: use rest_of_page() macro where appropriate
From: Yury Norov @ 2026-03-04 1:27 UTC (permalink / raw)
To: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jakub Kicinski, Jani Nikula, Janosch Frank,
Jaroslav Kysela, Jens Axboe, Joonas Lahtinen, Latchesar Ionkov,
Linus Walleij, Madhavan Srinivasan, Mark Brown, Michael Ellerman,
Miklos Szeredi, Namhyung Kim, Palmer Dabbelt, Paolo Abeni,
Paolo Bonzini, Paul Walmsley, Peter Zijlstra, Rodrigo Vivi,
Sean Christopherson, Simona Vetter, Takashi Iwai, Thomas Gleixner,
Trond Myklebust, Tvrtko Ursulin, Vasily Gorbik, Will Deacon,
Yury Norov, Zheng Gu
Cc: Yury Norov, linux-kernel, x86, linux-arm-kernel, linuxppc-dev,
linux-riscv, kvm, linux-s390, linux-block, intel-gfx, dri-devel,
dm-devel, netdev, linux-spi, linux-ext4, linux-f2fs-devel,
linux-fsdevel, linux-xfs, linux-nfs, linux-crypto, linux-mm,
linux-perf-users, v9fs, virtualization, linux-sound
In-Reply-To: <20260304012717.201797-1-ynorov@nvidia.com>
Switch SPI code to using the macro. No functional changes intended.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
drivers/spi/spi-pl022.c | 3 +--
drivers/spi/spi.c | 4 +---
2 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index c82cc522776d..78fce33ff422 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -761,8 +761,7 @@ static void setup_dma_scatter(struct pl022 *pl022,
* we just feed in this, else we stuff in as much
* as we can.
*/
- mapbytes = min_t(int, bytesleft,
- PAGE_SIZE - offset_in_page(bufp));
+ mapbytes = min_t(int, bytesleft, rest_of_page(bufp));
sg_set_page(sg, virt_to_page(bufp),
mapbytes, offset_in_page(bufp));
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 61f7bde8c7fb..cd4a18f3afaf 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1162,9 +1162,7 @@ static int spi_map_buf_attrs(struct spi_controller *ctlr, struct device *dev,
* the desc_len and the remaining buffer length that
* fits in a page.
*/
- min = min_t(size_t, desc_len,
- min_t(size_t, len,
- PAGE_SIZE - offset_in_page(buf)));
+ min = min_t(size_t, desc_len, min_t(size_t, len, rest_of_page(buf)));
if (vmalloced_buf)
vm_page = vmalloc_to_page(buf);
else
--
2.43.0
^ permalink raw reply related
* [PATCH 4/8] core: use rest_of_page() macro where appropriate
From: Yury Norov @ 2026-03-04 1:27 UTC (permalink / raw)
To: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jakub Kicinski, Jani Nikula, Janosch Frank,
Jaroslav Kysela, Jens Axboe, Joonas Lahtinen, Latchesar Ionkov,
Linus Walleij, Madhavan Srinivasan, Mark Brown, Michael Ellerman,
Miklos Szeredi, Namhyung Kim, Palmer Dabbelt, Paolo Abeni,
Paolo Bonzini, Paul Walmsley, Peter Zijlstra, Rodrigo Vivi,
Sean Christopherson, Simona Vetter, Takashi Iwai, Thomas Gleixner,
Trond Myklebust, Tvrtko Ursulin, Vasily Gorbik, Will Deacon,
Yury Norov, Zheng Gu
Cc: Yury Norov, linux-kernel, x86, linux-arm-kernel, linuxppc-dev,
linux-riscv, kvm, linux-s390, linux-block, intel-gfx, dri-devel,
dm-devel, netdev, linux-spi, linux-ext4, linux-f2fs-devel,
linux-fsdevel, linux-xfs, linux-nfs, linux-crypto, linux-mm,
linux-perf-users, v9fs, virtualization, linux-sound
In-Reply-To: <20260304012717.201797-1-ynorov@nvidia.com>
Switch core and library code to using the macro. No functional
changes intended.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
include/crypto/scatterwalk.h | 2 +-
include/linux/highmem.h | 24 ++++++++++--------------
include/linux/iomap.h | 2 +-
include/linux/iov_iter.h | 3 +--
kernel/events/ring_buffer.c | 2 +-
lib/bitmap-str.c | 2 +-
lib/iov_iter.c | 5 ++---
7 files changed, 17 insertions(+), 23 deletions(-)
diff --git a/include/crypto/scatterwalk.h b/include/crypto/scatterwalk.h
index 624fab589c2c..c671d5383c12 100644
--- a/include/crypto/scatterwalk.h
+++ b/include/crypto/scatterwalk.h
@@ -73,7 +73,7 @@ static inline unsigned int scatterwalk_clamp(struct scatter_walk *walk,
* page due to the data not being aligned to the algorithm's alignmask.
*/
if (IS_ENABLED(CONFIG_HIGHMEM))
- limit = PAGE_SIZE - offset_in_page(walk->offset);
+ limit = rest_of_page(walk->offset);
else
limit = PAGE_SIZE;
diff --git a/include/linux/highmem.h b/include/linux/highmem.h
index af03db851a1d..05528ba886fb 100644
--- a/include/linux/highmem.h
+++ b/include/linux/highmem.h
@@ -507,12 +507,10 @@ static inline void memcpy_folio(struct folio *dst_folio, size_t dst_off,
const char *src = kmap_local_folio(src_folio, src_off);
size_t chunk = len;
- if (folio_test_highmem(dst_folio) &&
- chunk > PAGE_SIZE - offset_in_page(dst_off))
- chunk = PAGE_SIZE - offset_in_page(dst_off);
- if (folio_test_highmem(src_folio) &&
- chunk > PAGE_SIZE - offset_in_page(src_off))
- chunk = PAGE_SIZE - offset_in_page(src_off);
+ if (folio_test_highmem(dst_folio) && chunk > rest_of_page(dst_off))
+ chunk = rest_of_page(dst_off);
+ if (folio_test_highmem(src_folio) && chunk > rest_of_page(src_off))
+ chunk = rest_of_page(src_off);
memcpy(dst, src, chunk);
kunmap_local(src);
kunmap_local(dst);
@@ -580,9 +578,8 @@ static inline void memcpy_from_folio(char *to, struct folio *folio,
const char *from = kmap_local_folio(folio, offset);
size_t chunk = len;
- if (folio_test_partial_kmap(folio) &&
- chunk > PAGE_SIZE - offset_in_page(offset))
- chunk = PAGE_SIZE - offset_in_page(offset);
+ if (folio_test_partial_kmap(folio) && chunk > rest_of_page(offset))
+ chunk = rest_of_page(offset);
memcpy(to, from, chunk);
kunmap_local(from);
@@ -608,9 +605,8 @@ static inline void memcpy_to_folio(struct folio *folio, size_t offset,
char *to = kmap_local_folio(folio, offset);
size_t chunk = len;
- if (folio_test_partial_kmap(folio) &&
- chunk > PAGE_SIZE - offset_in_page(offset))
- chunk = PAGE_SIZE - offset_in_page(offset);
+ if (folio_test_partial_kmap(folio) && chunk > rest_of_page(offset))
+ chunk = rest_of_page(offset);
memcpy(to, from, chunk);
kunmap_local(to);
@@ -642,7 +638,7 @@ static inline __must_check void *folio_zero_tail(struct folio *folio,
size_t len = folio_size(folio) - offset;
if (folio_test_partial_kmap(folio)) {
- size_t max = PAGE_SIZE - offset_in_page(offset);
+ size_t max = rest_of_page(offset);
while (len > max) {
memset(kaddr, 0, max);
@@ -680,7 +676,7 @@ static inline void folio_fill_tail(struct folio *folio, size_t offset,
VM_BUG_ON(offset + len > folio_size(folio));
if (folio_test_partial_kmap(folio)) {
- size_t max = PAGE_SIZE - offset_in_page(offset);
+ size_t max = rest_of_page(offset);
while (len > max) {
memcpy(to, from, max);
diff --git a/include/linux/iomap.h b/include/linux/iomap.h
index 99b7209dabd7..6ae549192adb 100644
--- a/include/linux/iomap.h
+++ b/include/linux/iomap.h
@@ -142,7 +142,7 @@ static inline void *iomap_inline_data(const struct iomap *iomap, loff_t pos)
*/
static inline bool iomap_inline_data_valid(const struct iomap *iomap)
{
- return iomap->length <= PAGE_SIZE - offset_in_page(iomap->inline_data);
+ return iomap->length <= rest_of_page(iomap->inline_data);
}
/*
diff --git a/include/linux/iov_iter.h b/include/linux/iov_iter.h
index f9a17fbbd398..13a9ee653ef8 100644
--- a/include/linux/iov_iter.h
+++ b/include/linux/iov_iter.h
@@ -227,8 +227,7 @@ size_t iterate_xarray(struct iov_iter *iter, size_t len, void *priv, void *priv2
while (flen) {
void *base = kmap_local_folio(folio, offset);
- part = min_t(size_t, flen,
- PAGE_SIZE - offset_in_page(offset));
+ part = min_t(size_t, flen, rest_of_page(offset));
remain = step(base, progress, part, priv, priv2);
kunmap_local(base);
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 3e7de2661417..1db2868b90c9 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -590,7 +590,7 @@ long perf_output_copy_aux(struct perf_output_handle *aux_handle,
to &= (rb->aux_nr_pages << PAGE_SHIFT) - 1;
do {
- tocopy = PAGE_SIZE - offset_in_page(from);
+ tocopy = rest_of_page(from);
if (to > from)
tocopy = min(tocopy, to - from);
if (!tocopy)
diff --git a/lib/bitmap-str.c b/lib/bitmap-str.c
index be745209507a..a357342d5d6c 100644
--- a/lib/bitmap-str.c
+++ b/lib/bitmap-str.c
@@ -58,7 +58,7 @@ EXPORT_SYMBOL(bitmap_parse_user);
int bitmap_print_to_pagebuf(bool list, char *buf, const unsigned long *maskp,
int nmaskbits)
{
- ptrdiff_t len = PAGE_SIZE - offset_in_page(buf);
+ ptrdiff_t len = rest_of_page(buf);
return list ? scnprintf(buf, len, "%*pbl\n", nmaskbits, maskp) :
scnprintf(buf, len, "%*pb\n", nmaskbits, maskp);
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 0a63c7fba313..c7e812349ca2 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -483,9 +483,8 @@ size_t copy_folio_from_iter_atomic(struct folio *folio, size_t offset,
char *to = kmap_local_folio(folio, offset);
n = bytes - copied;
- if (folio_test_partial_kmap(folio) &&
- n > PAGE_SIZE - offset_in_page(offset))
- n = PAGE_SIZE - offset_in_page(offset);
+ if (folio_test_partial_kmap(folio) && n > rest_of_page(offset))
+ n = rest_of_page(offset);
pagefault_disable();
n = __copy_from_iter(to, n, i);
--
2.43.0
^ permalink raw reply related
* [PATCH 3/8] net: use rest_of_page() macro where appropriate
From: Yury Norov @ 2026-03-04 1:27 UTC (permalink / raw)
To: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jakub Kicinski, Jani Nikula, Janosch Frank,
Jaroslav Kysela, Jens Axboe, Joonas Lahtinen, Latchesar Ionkov,
Linus Walleij, Madhavan Srinivasan, Mark Brown, Michael Ellerman,
Miklos Szeredi, Namhyung Kim, Palmer Dabbelt, Paolo Abeni,
Paolo Bonzini, Paul Walmsley, Peter Zijlstra, Rodrigo Vivi,
Sean Christopherson, Simona Vetter, Takashi Iwai, Thomas Gleixner,
Trond Myklebust, Tvrtko Ursulin, Vasily Gorbik, Will Deacon,
Yury Norov, Zheng Gu
Cc: Yury Norov, linux-kernel, x86, linux-arm-kernel, linuxppc-dev,
linux-riscv, kvm, linux-s390, linux-block, intel-gfx, dri-devel,
dm-devel, netdev, linux-spi, linux-ext4, linux-f2fs-devel,
linux-fsdevel, linux-xfs, linux-nfs, linux-crypto, linux-mm,
linux-perf-users, v9fs, virtualization, linux-sound
In-Reply-To: <20260304012717.201797-1-ynorov@nvidia.com>
Switch networking codebase to using the macro. No functional changes
intended.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | 6 +++---
drivers/s390/net/qeth_core_main.c | 6 ++----
2 files changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_tlv.c b/drivers/net/ethernet/meta/fbnic/fbnic_tlv.c
index 517ed8b2f1cb..2e80c25ba3c8 100644
--- a/drivers/net/ethernet/meta/fbnic/fbnic_tlv.c
+++ b/drivers/net/ethernet/meta/fbnic/fbnic_tlv.c
@@ -52,7 +52,7 @@ struct fbnic_tlv_msg *fbnic_tlv_msg_alloc(u16 msg_id)
**/
int fbnic_tlv_attr_put_flag(struct fbnic_tlv_msg *msg, const u16 attr_id)
{
- int attr_max_len = PAGE_SIZE - offset_in_page(msg) - sizeof(*msg);
+ int attr_max_len = rest_of_page(msg) - sizeof(*msg);
struct fbnic_tlv_hdr hdr = { 0 };
struct fbnic_tlv_msg *attr;
@@ -94,7 +94,7 @@ int fbnic_tlv_attr_put_flag(struct fbnic_tlv_msg *msg, const u16 attr_id)
int fbnic_tlv_attr_put_value(struct fbnic_tlv_msg *msg, const u16 attr_id,
const void *value, const int len)
{
- int attr_max_len = PAGE_SIZE - offset_in_page(msg) - sizeof(*msg);
+ int attr_max_len = rest_of_page(msg) - sizeof(*msg);
struct fbnic_tlv_hdr hdr = { 0 };
struct fbnic_tlv_msg *attr;
@@ -292,7 +292,7 @@ ssize_t fbnic_tlv_attr_get_string(struct fbnic_tlv_msg *attr, char *dst,
struct fbnic_tlv_msg *fbnic_tlv_attr_nest_start(struct fbnic_tlv_msg *msg,
u16 attr_id)
{
- int attr_max_len = PAGE_SIZE - offset_in_page(msg) - sizeof(*msg);
+ int attr_max_len = rest_of_page(msg) - sizeof(*msg);
struct fbnic_tlv_msg *attr = &msg[le16_to_cpu(msg->hdr.len)];
struct fbnic_tlv_hdr hdr = { 0 };
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index cf5f760d0e02..5012c22d8f37 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -4087,8 +4087,7 @@ static unsigned int qeth_fill_buffer(struct qeth_qdio_out_buffer *buf,
/* map linear part into buffer element(s) */
while (length > 0) {
- elem_length = min_t(unsigned int, length,
- PAGE_SIZE - offset_in_page(data));
+ elem_length = min_t(unsigned int, length, rest_of_page(data));
buffer->element[element].addr = virt_to_dma64(data);
buffer->element[element].length = elem_length;
@@ -4117,8 +4116,7 @@ static unsigned int qeth_fill_buffer(struct qeth_qdio_out_buffer *buf,
data = skb_frag_address(frag);
length = skb_frag_size(frag);
while (length > 0) {
- elem_length = min_t(unsigned int, length,
- PAGE_SIZE - offset_in_page(data));
+ elem_length = min_t(unsigned int, length, rest_of_page(data));
buffer->element[element].addr = virt_to_dma64(data);
buffer->element[element].length = elem_length;
--
2.43.0
^ permalink raw reply related
* [PATCH 2/8] fs: use rest_of_page() macro where appropriate
From: Yury Norov @ 2026-03-04 1:27 UTC (permalink / raw)
To: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jakub Kicinski, Jani Nikula, Janosch Frank,
Jaroslav Kysela, Jens Axboe, Joonas Lahtinen, Latchesar Ionkov,
Linus Walleij, Madhavan Srinivasan, Mark Brown, Michael Ellerman,
Miklos Szeredi, Namhyung Kim, Palmer Dabbelt, Paolo Abeni,
Paolo Bonzini, Paul Walmsley, Peter Zijlstra, Rodrigo Vivi,
Sean Christopherson, Simona Vetter, Takashi Iwai, Thomas Gleixner,
Trond Myklebust, Tvrtko Ursulin, Vasily Gorbik, Will Deacon,
Yury Norov, Zheng Gu
Cc: Yury Norov, linux-kernel, x86, linux-arm-kernel, linuxppc-dev,
linux-riscv, kvm, linux-s390, linux-block, intel-gfx, dri-devel,
dm-devel, netdev, linux-spi, linux-ext4, linux-f2fs-devel,
linux-fsdevel, linux-xfs, linux-nfs, linux-crypto, linux-mm,
linux-perf-users, v9fs, virtualization, linux-sound
In-Reply-To: <20260304012717.201797-1-ynorov@nvidia.com>
Switch filesystem codebase to using the macro. No functional changes
intended.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
fs/ext4/verity.c | 3 +--
fs/f2fs/verity.c | 6 ++----
fs/fuse/dev.c | 4 ++--
fs/iomap/buffered-io.c | 2 +-
fs/nfs/pagelist.c | 2 +-
fs/remap_range.c | 3 +--
fs/xfs/scrub/xfile.c | 3 +--
7 files changed, 9 insertions(+), 14 deletions(-)
diff --git a/fs/ext4/verity.c b/fs/ext4/verity.c
index ca61da53f313..3dc95581e4b1 100644
--- a/fs/ext4/verity.c
+++ b/fs/ext4/verity.c
@@ -74,8 +74,7 @@ static int pagecache_write(struct inode *inode, const void *buf, size_t count,
return -EFBIG;
while (count) {
- size_t n = min_t(size_t, count,
- PAGE_SIZE - offset_in_page(pos));
+ size_t n = min_t(size_t, count, rest_of_page(pos));
struct folio *folio;
void *fsdata = NULL;
int res;
diff --git a/fs/f2fs/verity.c b/fs/f2fs/verity.c
index 92ebcc19cab0..1c3403fbf2a8 100644
--- a/fs/f2fs/verity.c
+++ b/fs/f2fs/verity.c
@@ -44,8 +44,7 @@ static int pagecache_read(struct inode *inode, void *buf, size_t count,
loff_t pos)
{
while (count) {
- size_t n = min_t(size_t, count,
- PAGE_SIZE - offset_in_page(pos));
+ size_t n = min_t(size_t, count, rest_of_page(pos));
struct page *page;
page = read_mapping_page(inode->i_mapping, pos >> PAGE_SHIFT,
@@ -78,8 +77,7 @@ static int pagecache_write(struct inode *inode, const void *buf, size_t count,
return -EFBIG;
while (count) {
- size_t n = min_t(size_t, count,
- PAGE_SIZE - offset_in_page(pos));
+ size_t n = min_t(size_t, count, rest_of_page(pos));
struct folio *folio;
void *fsdata = NULL;
int res;
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 0b0241f47170..efd7e6ca929e 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1157,8 +1157,8 @@ static int fuse_copy_folio(struct fuse_copy_state *cs, struct folio **foliop,
unsigned int copy = count;
unsigned int bytes_copied;
- if (folio_test_highmem(folio) && count > PAGE_SIZE - offset_in_page(offset))
- copy = PAGE_SIZE - offset_in_page(offset);
+ if (folio_test_highmem(folio) && count > rest_of_page(offset))
+ copy = rest_of_page(offset);
bytes_copied = fuse_copy_do(cs, &buf, ©);
kunmap_local(mapaddr);
diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index bc82083e420a..99e56ee6c3d6 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -852,7 +852,7 @@ static struct folio *__iomap_get_folio(struct iomap_iter *iter,
loff_t pos = iter->pos;
if (!mapping_large_folio_support(iter->inode->i_mapping))
- len = min_t(size_t, len, PAGE_SIZE - offset_in_page(pos));
+ len = min_t(size_t, len, rest_of_page(pos));
if (iter->iomap.flags & IOMAP_F_FOLIO_BATCH) {
struct folio *folio = folio_batch_next(iter->fbatch);
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index a9373de891c9..221a90f57812 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -60,7 +60,7 @@ static struct page *nfs_page_iter_page_get(struct nfs_page_iter_page *i)
if (i->count != req->wb_bytes) {
size_t base = i->count + req->wb_pgbase;
- size_t len = PAGE_SIZE - offset_in_page(base);
+ size_t len = rest_of_page(base);
page = nfs_page_to_page(req, base);
nfs_page_iter_page_advance(i, len);
diff --git a/fs/remap_range.c b/fs/remap_range.c
index 26afbbbfb10c..83f325e7f96b 100644
--- a/fs/remap_range.c
+++ b/fs/remap_range.c
@@ -199,8 +199,7 @@ static int vfs_dedupe_file_range_compare(struct file *src, loff_t srcoff,
while (len) {
struct folio *src_folio, *dst_folio;
void *src_addr, *dst_addr;
- loff_t cmp_len = min(PAGE_SIZE - offset_in_page(srcoff),
- PAGE_SIZE - offset_in_page(dstoff));
+ loff_t cmp_len = min(rest_of_page(srcoff), rest_of_page(dstoff));
cmp_len = min(cmp_len, len);
if (cmp_len <= 0)
diff --git a/fs/xfs/scrub/xfile.c b/fs/xfs/scrub/xfile.c
index 05581571854d..95707407aa6b 100644
--- a/fs/xfs/scrub/xfile.c
+++ b/fs/xfs/scrub/xfile.c
@@ -135,8 +135,7 @@ xfile_load(
* No data stored at this offset, just zero the output
* buffer until the next page boundary.
*/
- len = min_t(ssize_t, count,
- PAGE_SIZE - offset_in_page(pos));
+ len = min_t(ssize_t, count, rest_of_page(pos));
memset(buf, 0, len);
} else {
if (filemap_check_wb_err(inode->i_mapping, 0)) {
--
2.43.0
^ permalink raw reply related
* [PATCH 1/8] mm: add rest_of_page() macro
From: Yury Norov @ 2026-03-04 1:27 UTC (permalink / raw)
To: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jakub Kicinski, Jani Nikula, Janosch Frank,
Jaroslav Kysela, Jens Axboe, Joonas Lahtinen, Latchesar Ionkov,
Linus Walleij, Madhavan Srinivasan, Mark Brown, Michael Ellerman,
Miklos Szeredi, Namhyung Kim, Palmer Dabbelt, Paolo Abeni,
Paolo Bonzini, Paul Walmsley, Peter Zijlstra, Rodrigo Vivi,
Sean Christopherson, Simona Vetter, Takashi Iwai, Thomas Gleixner,
Trond Myklebust, Tvrtko Ursulin, Vasily Gorbik, Will Deacon,
Yury Norov, Zheng Gu
Cc: Yury Norov, linux-kernel, x86, linux-arm-kernel, linuxppc-dev,
linux-riscv, kvm, linux-s390, linux-block, intel-gfx, dri-devel,
dm-devel, netdev, linux-spi, linux-ext4, linux-f2fs-devel,
linux-fsdevel, linux-xfs, linux-nfs, linux-crypto, linux-mm,
linux-perf-users, v9fs, virtualization, linux-sound
In-Reply-To: <20260304012717.201797-1-ynorov@nvidia.com>
The net/9p networking driver has a handy macro to calculate the
amount of bytes from a given pointer to the end of page. Move it
to mm. The following patches apply it tree-wide.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
include/linux/mm.h | 2 ++
net/9p/trans_virtio.c | 6 ------
2 files changed, 2 insertions(+), 6 deletions(-)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 5be3d8a8f806..6d1025c6249a 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -2793,6 +2793,8 @@ extern void pagefault_out_of_memory(void);
#define offset_in_page(p) ((unsigned long)(p) & ~PAGE_MASK)
#define offset_in_folio(folio, p) ((unsigned long)(p) & (folio_size(folio) - 1))
+#define rest_of_page(p) (PAGE_SIZE - offset_in_page(p))
+
/*
* Parameter block passed down to zap_pte_range in exceptional cases.
*/
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 4cdab7094b27..1ca53209d036 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -87,12 +87,6 @@ struct virtio_chan {
static struct list_head virtio_chan_list;
-/* How many bytes left in this page. */
-static unsigned int rest_of_page(void *data)
-{
- return PAGE_SIZE - offset_in_page(data);
-}
-
/**
* p9_virtio_close - reclaim resources of a channel
* @client: client instance
--
2.43.0
^ permalink raw reply related
* [PATCH 0/8] mm: globalize rest_of_page() macro
From: Yury Norov @ 2026-03-04 1:27 UTC (permalink / raw)
To: Andrew Morton, David S. Miller, Michael S. Tsirkin,
Theodore Ts'o, Albert Ou, Alexander Duyck, Alexander Gordeev,
Alexander Viro, Alexandra Winter, Andreas Dilger, Andrew Lunn,
Anna Schumaker, Anton Yakovlev, Arnaldo Carvalho de Melo,
Aswin Karuvally, Borislav Petkov, Carlos Maiolino,
Catalin Marinas, Chao Yu, Christian Borntraeger,
Christian Brauner, Claudio Imbrenda, Dave Hansen, David Airlie,
Dominique Martinet, Dongsheng Yang, Eric Dumazet,
Eric Van Hensbergen, Heiko Carstens, Herbert Xu, Ingo Molnar,
Jaegeuk Kim, Jakub Kicinski, Jani Nikula, Janosch Frank,
Jaroslav Kysela, Jens Axboe, Joonas Lahtinen, Latchesar Ionkov,
Linus Walleij, Madhavan Srinivasan, Mark Brown, Michael Ellerman,
Miklos Szeredi, Namhyung Kim, Palmer Dabbelt, Paolo Abeni,
Paolo Bonzini, Paul Walmsley, Peter Zijlstra, Rodrigo Vivi,
Sean Christopherson, Simona Vetter, Takashi Iwai, Thomas Gleixner,
Trond Myklebust, Tvrtko Ursulin, Vasily Gorbik, Will Deacon,
Yury Norov, Zheng Gu
Cc: Yury Norov, linux-kernel, x86, linux-arm-kernel, linuxppc-dev,
linux-riscv, kvm, linux-s390, linux-block, intel-gfx, dri-devel,
dm-devel, netdev, linux-spi, linux-ext4, linux-f2fs-devel,
linux-fsdevel, linux-xfs, linux-nfs, linux-crypto, linux-mm,
linux-perf-users, v9fs, virtualization, linux-sound
The net/9p networking driver has a handy macro to calculate the
amount of bytes from a given pointer to the end of page. Move it
to core/mm, and apply tree-wide. No functional changes intended.
This series was originally introduced as a single patch #07/12 in:
https://lore.kernel.org/all/20260219181407.290201-1-ynorov@nvidia.com/
Split it for better granularity and submit separately.
Yury Norov (8):
mm: add rest_of_page() macro
fs: use rest_of_page() macro where appropriate
net: use rest_of_page() macro where appropriate
core: use rest_of_page() macro where appropriate
spi: use rest_of_page() macro where appropriate
KVM: use rest_of_page() macro where appropriate
drivers: ALSA: use rest_of_page() macro where appropriate
arch: use rest_of_page() macro where appropriate
arch/arm64/kernel/patching.c | 4 +---
arch/powerpc/lib/code-patching.c | 6 +++---
arch/riscv/kernel/sbi.c | 4 ++--
arch/s390/kvm/gaccess.c | 6 +++---
arch/x86/kvm/emulate.c | 4 ++--
drivers/block/null_blk/main.c | 6 ++----
drivers/gpu/drm/i915/gt/shmem_utils.c | 5 ++---
drivers/md/dm-pcache/backing_dev.h | 2 +-
drivers/net/ethernet/meta/fbnic/fbnic_tlv.c | 6 +++---
drivers/s390/net/qeth_core_main.c | 6 ++----
drivers/spi/spi-pl022.c | 3 +--
drivers/spi/spi.c | 4 +---
fs/ext4/verity.c | 3 +--
fs/f2fs/verity.c | 6 ++----
fs/fuse/dev.c | 4 ++--
fs/iomap/buffered-io.c | 2 +-
fs/nfs/pagelist.c | 2 +-
fs/remap_range.c | 3 +--
fs/xfs/scrub/xfile.c | 3 +--
include/crypto/scatterwalk.h | 2 +-
include/linux/highmem.h | 24 +++++++++------------
include/linux/iomap.h | 2 +-
include/linux/iov_iter.h | 3 +--
include/linux/mm.h | 2 ++
kernel/events/ring_buffer.c | 2 +-
lib/bitmap-str.c | 2 +-
lib/iov_iter.c | 5 ++---
net/9p/trans_virtio.c | 6 ------
sound/virtio/virtio_pcm_msg.c | 4 ++--
29 files changed, 53 insertions(+), 78 deletions(-)
--
2.43.0
^ permalink raw reply
* Re: [PATCH v2 053/110] uprobes: use PRIino format for i_ino
From: Masami Hiramatsu @ 2026-03-04 1:12 UTC (permalink / raw)
To: Jeff Layton
Cc: Alexander Viro, Christian Brauner, Jan Kara, Steven Rostedt,
Mathieu Desnoyers, Dan Williams, Matthew Wilcox, Eric Biggers,
Theodore Y. Ts'o, Muchun Song, Oscar Salvador,
David Hildenbrand, David Howells, Paulo Alcantara, Andreas Dilger,
Jan Kara, Jaegeuk Kim, Chao Yu, Trond Myklebust, Anna Schumaker,
Chuck Lever, NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey,
Steve French, Ronnie Sahlberg, Shyam Prasad N, Bharath SM,
Alexander Aring, Ryusuke Konishi, Viacheslav Dubeyko,
Eric Van Hensbergen, Latchesar Ionkov, Dominique Martinet,
Christian Schoenebeck, David Sterba, Marc Dionne, Ian Kent,
Luis de Bethencourt, Salah Triki, Tigran A. Aivazian,
Ilya Dryomov, Alex Markuze, Jan Harkes, coda, Nicolas Pitre,
Tyler Hicks, Amir Goldstein, Christoph Hellwig,
John Paul Adrian Glaubitz, Yangtao Li, Mikulas Patocka,
David Woodhouse, Richard Weinberger, Dave Kleikamp,
Konstantin Komarov, Mark Fasheh, Joel Becker, Joseph Qi,
Mike Marshall, Martin Brandenburg, Miklos Szeredi, Anders Larsen,
Zhihao Cheng, Damien Le Moal, Naohiro Aota, Johannes Thumshirn,
John Johansen, Paul Moore, James Morris, Serge E. Hallyn,
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Fan Wu,
Stephen Smalley, Ondrej Mosnacek, Casey Schaufler, Alex Deucher,
Christian König, David Airlie, Simona Vetter, Sumit Semwal,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
David S. Miller, Jakub Kicinski, Simon Horman, Oleg Nesterov,
Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, Darrick J. Wong,
Martin Schiller, Eric Paris, Joerg Reuter, Marcel Holtmann,
Johan Hedberg, Luiz Augusto von Dentz, Oliver Hartkopp,
Marc Kleine-Budde, David Ahern, Neal Cardwell, Steffen Klassert,
Herbert Xu, Remi Denis-Courmont, Marcelo Ricardo Leitner,
Xin Long, Magnus Karlsson, Maciej Fijalkowski, Stanislav Fomichev,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend, linux-fsdevel, linux-kernel, linux-trace-kernel,
nvdimm, fsverity, linux-mm, netfs, linux-ext4, linux-f2fs-devel,
linux-nfs, linux-cifs, samba-technical, linux-nilfs, v9fs,
linux-afs, autofs, ceph-devel, codalist, ecryptfs, linux-mtd,
jfs-discussion, ntfs3, ocfs2-devel, devel, linux-unionfs,
apparmor, linux-security-module, linux-integrity, selinux,
amd-gfx, dri-devel, linux-media, linaro-mm-sig, netdev,
linux-perf-users, linux-fscrypt, linux-xfs, linux-hams, linux-x25,
audit, linux-bluetooth, linux-can, linux-sctp, bpf
In-Reply-To: <20260302-iino-u64-v2-53-e5388800dae0@kernel.org>
On Mon, 02 Mar 2026 15:24:37 -0500
Jeff Layton <jlayton@kernel.org> wrote:
> Convert uprobes i_ino format strings to use the PRIino format
> macro in preparation for the widening of i_ino via kino_t.
>
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
Looks good to me.
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Thanks,
> ---
> kernel/events/uprobes.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
> index 923b24b321cc0fbdecaf016645cdac0457a74463..d5bf51565851223730c63b50436c493c0c05eafd 100644
> --- a/kernel/events/uprobes.c
> +++ b/kernel/events/uprobes.c
> @@ -344,7 +344,7 @@ __update_ref_ctr(struct mm_struct *mm, unsigned long vaddr, short d)
> static void update_ref_ctr_warn(struct uprobe *uprobe,
> struct mm_struct *mm, short d)
> {
> - pr_warn("ref_ctr %s failed for inode: 0x%lx offset: "
> + pr_warn("ref_ctr %s failed for inode: 0x%" PRIino "x offset: "
> "0x%llx ref_ctr_offset: 0x%llx of mm: 0x%p\n",
> d > 0 ? "increment" : "decrement", uprobe->inode->i_ino,
> (unsigned long long) uprobe->offset,
> @@ -982,7 +982,7 @@ static struct uprobe *insert_uprobe(struct uprobe *uprobe)
> static void
> ref_ctr_mismatch_warn(struct uprobe *cur_uprobe, struct uprobe *uprobe)
> {
> - pr_warn("ref_ctr_offset mismatch. inode: 0x%lx offset: 0x%llx "
> + pr_warn("ref_ctr_offset mismatch. inode: 0x%" PRIino "x offset: 0x%llx "
> "ref_ctr_offset(old): 0x%llx ref_ctr_offset(new): 0x%llx\n",
> uprobe->inode->i_ino, (unsigned long long) uprobe->offset,
> (unsigned long long) cur_uprobe->ref_ctr_offset,
>
> --
> 2.53.0
>
--
Masami Hiramatsu (Google) <mhiramat@kernel.org>
^ permalink raw reply
* [syzbot] Monthly ext4 report (Mar 2026)
From: syzbot @ 2026-03-03 23:42 UTC (permalink / raw)
To: linux-ext4, linux-kernel, syzkaller-bugs
Hello ext4 maintainers/developers,
This is a 31-day syzbot report for the ext4 subsystem.
All related reports/information can be found at:
https://syzkaller.appspot.com/upstream/s/ext4
During the period, 7 new issues were detected and 0 were fixed.
In total, 55 issues are still open and 170 have already been fixed.
Some of the still happening issues:
Ref Crashes Repro Title
<1> 6756 Yes KASAN: out-of-bounds Read in ext4_xattr_set_entry
https://syzkaller.appspot.com/bug?extid=f792df426ff0f5ceb8d1
<2> 5047 Yes WARNING in ext4_xattr_inode_update_ref (2)
https://syzkaller.appspot.com/bug?extid=76916a45d2294b551fd9
<3> 4148 Yes possible deadlock in ext4_writepages (2)
https://syzkaller.appspot.com/bug?extid=eb5b4ef634a018917f3c
<4> 2977 Yes kernel BUG in ext4_do_writepages
https://syzkaller.appspot.com/bug?extid=d1da16f03614058fdc48
<5> 2936 Yes INFO: task hung in sync_inodes_sb (5)
https://syzkaller.appspot.com/bug?extid=30476ec1b6dc84471133
<6> 2170 Yes INFO: task hung in jbd2_journal_commit_transaction (5)
https://syzkaller.appspot.com/bug?extid=3071bdd0a9953bc0d177
<7> 1607 Yes possible deadlock in ext4_destroy_inline_data (2)
https://syzkaller.appspot.com/bug?extid=bb2455d02bda0b5701e3
<8> 994 Yes WARNING in ext4_xattr_inode_lookup_create
https://syzkaller.appspot.com/bug?extid=fe42a669c87e4a980051
<9> 575 Yes possible deadlock in do_writepages (2)
https://syzkaller.appspot.com/bug?extid=756f498a88797cda9299
<10> 464 Yes INFO: task hung in do_get_write_access (3)
https://syzkaller.appspot.com/bug?extid=e7c786ece54bad9d1e43
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
To disable reminders for individual bugs, reply with the following command:
#syz set <Ref> no-reminders
To change bug's subsystems, reply with:
#syz set <Ref> subsystems: new-subsystem
You may send multiple commands in a single email message.
^ permalink raw reply
* [syzbot ci] Re: fs: Move metadata bh tracking from address_space
From: syzbot ci @ 2026-03-03 23:35 UTC (permalink / raw)
To: agruenba, aivazian.tigran, almaz.alexandrovich, axboe, bcrl,
brauner, david, dsterba, gfs2, hirofumi, jack, jlbec, joseph.qi,
linux-aio, linux-block, linux-ext4, linux-fsdevel, linux-mm,
muchun.song, ntfs3, ocfs2-devel, osalvador, tytso, viro
Cc: syzbot, syzkaller-bugs
In-Reply-To: <20260303101717.27224-1-jack@suse.cz>
syzbot ci has tested the following series
[v1] fs: Move metadata bh tracking from address_space
https://lore.kernel.org/all/20260303101717.27224-1-jack@suse.cz
* [PATCH 01/32] fat: Sync and invalidate metadata buffers from fat_evict_inode()
* [PATCH 02/32] udf: Sync and invalidate metadata buffers from udf_evict_inode()
* [PATCH 03/32] minix: Sync and invalidate metadata buffers from minix_evict_inode()
* [PATCH 04/32] ext2: Sync and invalidate metadata buffers from ext2_evict_inode()
* [PATCH 05/32] ext4: Sync and invalidate metadata buffers from ext4_evict_inode()
* [PATCH 06/32] ext4: Use inode_has_buffers()
* [PATCH 07/32] bfs: Sync and invalidate metadata buffers from bfs_evict_inode()
* [PATCH 08/32] affs: Sync and invalidate metadata buffers from affs_evict_inode()
* [PATCH 09/32] fs: Ignore inode metadata buffers in inode_lru_isolate()
* [PATCH 10/32] fs: Stop using i_private_data for metadata bh tracking
* [PATCH 11/32] gfs2: Don't zero i_private_data
* [PATCH 12/32] hugetlbfs: Stop using i_private_data
* [PATCH 13/32] aio: Stop using i_private_data and i_private_lock
* [PATCH 14/32] fs: Remove i_private_data
* [PATCH 15/32] fs: Drop osync_buffers_list()
* [PATCH 16/32] fs: Fold fsync_buffers_list() into sync_mapping_buffers()
* [PATCH 17/32] fs: Move metadata bhs tracking to a separate struct
* [PATCH 18/32] fs: Provide operation for fetching mapping_metadata_bhs
* [PATCH 19/32] ntfs3: Drop pointless sync_mapping_buffers() call
* [PATCH 20/32] ocfs2: Drop pointless sync_mapping_buffers() calls
* [PATCH 21/32] bdev: Drop pointless invalidate_mapping_buffers() call
* [PATCH 22/32] fs: Switch inode_has_buffers() to take mapping_metadata_bhs
* [PATCH 23/32] ext2: Track metadata bhs in fs-private inode part
* [PATCH 24/32] affs: Track metadata bhs in fs-private inode part
* [PATCH 25/32] bfs: Track metadata bhs in fs-private inode part
* [PATCH 26/32] fat: Track metadata bhs in fs-private inode part
* [PATCH 27/32] udf: Track metadata bhs in fs-private inode part
* [PATCH 28/32] minix: Track metadata bhs in fs-private inode part
* [PATCH 29/32] ext4: Track metadata bhs in fs-private inode part
* [PATCH 30/32] vfs: Drop mapping_metadata_bhs from address space
* [PATCH 31/32] kvm: Use private inode list instead of i_private_list
* [PATCH 32/32] fs: Drop i_private_list from address_space
and found the following issues:
* BUG: spinlock bad magic in region_del
* KASAN: slab-use-after-free Read in region_del
* general protection fault in mark_buffer_dirty_inode
Full report is available here:
https://ci.syzbot.org/series/3cf14b16-7f50-44ce-9f95-8ac4b86cf294
***
BUG: spinlock bad magic in region_del
tree: mm-new
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/akpm/mm.git
base: f50c6ce7bf30099042dac755fbd1e97da456f5ec
arch: amd64
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
config: https://ci.syzbot.org/builds/e716ec88-6c00-48e7-868d-3f4cb3999d4b/config
syz repro: https://ci.syzbot.org/findings/0d1bc933-ce69-432e-a2d5-b2411fe4cfec/syz_repro
BUG: spinlock bad magic on CPU#0, syz.0.151/6273
lock: 0xffff8881165dc808, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
CPU: 0 UID: 0 PID: 6273 Comm: syz.0.151 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
spin_bug kernel/locking/spinlock_debug.c:78 [inline]
debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
do_raw_spin_lock+0x1e5/0x2f0 kernel/locking/spinlock_debug.c:115
spin_lock include/linux/spinlock.h:341 [inline]
region_del+0xbe/0x950 mm/hugetlb.c:863
hugetlb_unreserve_pages+0xfa/0x230 mm/hugetlb.c:6757
remove_inode_hugepages+0x1036/0x11a0 fs/hugetlbfs/inode.c:613
hugetlbfs_evict_inode+0xaf/0x260 fs/hugetlbfs/inode.c:623
evict+0x61e/0xb10 fs/inode.c:841
__dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
finish_dput+0xc9/0x480 fs/dcache.c:879
do_one_tree fs/dcache.c:1657 [inline]
shrink_dcache_for_umount+0xe1/0x1f0 fs/dcache.c:1671
generic_shutdown_super+0x6f/0x2d0 fs/super.c:624
kill_anon_super+0x3b/0x70 fs/super.c:1292
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x69b/0x2320 kernel/exit.c:971
do_group_exit+0x21b/0x2d0 kernel/exit.c:1112
get_signal+0x1284/0x1330 kernel/signal.c:3034
arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6e0f19c799
Code: Unable to access opcode bytes at 0x7f6e0f19c76f.
RSP: 002b:00007f6e101360e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f6e0f415fa8 RCX: 00007f6e0f19c799
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6e0f415fa8
RBP: 00007f6e0f415fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6e0f416038 R14: 00007fff1de1a520 R15: 00007fff1de1a608
</TASK>
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 6273 Comm: syz.0.151 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:region_del+0x108/0x950 mm/hugetlb.c:864
Code: 24 20 49 29 c4 4c 03 23 48 89 03 48 8b 5c 24 40 4c 39 eb 0f 84 64 05 00 00 e8 74 c0 9c ff 4c 89 64 24 10 49 89 df 49 c1 ef 03 <41> 80 3c 2f 00 74 08 48 89 df e8 b9 d8 06 00 48 8b 03 48 89 44 24
RSP: 0018:ffffc90003b17330 EFLAGS: 00010246
RAX: a69e65823ec40000 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90003b172a0
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000762e54 R12: 0000000000000000
R13: ffff8881165dc848 R14: 1ffff11022cbb909 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88818de67000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc23744ea7c CR3: 000000000e54c000 CR4: 00000000000006f0
Call Trace:
<TASK>
hugetlb_unreserve_pages+0xfa/0x230 mm/hugetlb.c:6757
remove_inode_hugepages+0x1036/0x11a0 fs/hugetlbfs/inode.c:613
hugetlbfs_evict_inode+0xaf/0x260 fs/hugetlbfs/inode.c:623
evict+0x61e/0xb10 fs/inode.c:841
__dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
finish_dput+0xc9/0x480 fs/dcache.c:879
do_one_tree fs/dcache.c:1657 [inline]
shrink_dcache_for_umount+0xe1/0x1f0 fs/dcache.c:1671
generic_shutdown_super+0x6f/0x2d0 fs/super.c:624
kill_anon_super+0x3b/0x70 fs/super.c:1292
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x69b/0x2320 kernel/exit.c:971
do_group_exit+0x21b/0x2d0 kernel/exit.c:1112
get_signal+0x1284/0x1330 kernel/signal.c:3034
arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6e0f19c799
Code: Unable to access opcode bytes at 0x7f6e0f19c76f.
RSP: 002b:00007f6e101360e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f6e0f415fa8 RCX: 00007f6e0f19c799
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6e0f415fa8
RBP: 00007f6e0f415fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6e0f416038 R14: 00007fff1de1a520 R15: 00007fff1de1a608
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:region_del+0x108/0x950 mm/hugetlb.c:864
Code: 24 20 49 29 c4 4c 03 23 48 89 03 48 8b 5c 24 40 4c 39 eb 0f 84 64 05 00 00 e8 74 c0 9c ff 4c 89 64 24 10 49 89 df 49 c1 ef 03 <41> 80 3c 2f 00 74 08 48 89 df e8 b9 d8 06 00 48 8b 03 48 89 44 24
RSP: 0018:ffffc90003b17330 EFLAGS: 00010246
RAX: a69e65823ec40000 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90003b172a0
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000762e54 R12: 0000000000000000
R13: ffff8881165dc848 R14: 1ffff11022cbb909 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88818de67000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc23744ea7c CR3: 000000000e54c000 CR4: 00000000000006f0
----------------
Code disassembly (best guess):
0: 24 20 and $0x20,%al
2: 49 29 c4 sub %rax,%r12
5: 4c 03 23 add (%rbx),%r12
8: 48 89 03 mov %rax,(%rbx)
b: 48 8b 5c 24 40 mov 0x40(%rsp),%rbx
10: 4c 39 eb cmp %r13,%rbx
13: 0f 84 64 05 00 00 je 0x57d
19: e8 74 c0 9c ff call 0xff9cc092
1e: 4c 89 64 24 10 mov %r12,0x10(%rsp)
23: 49 89 df mov %rbx,%r15
26: 49 c1 ef 03 shr $0x3,%r15
* 2a: 41 80 3c 2f 00 cmpb $0x0,(%r15,%rbp,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 b9 d8 06 00 call 0x6d8f2
39: 48 8b 03 mov (%rbx),%rax
3c: 48 rex.W
3d: 89 .byte 0x89
3e: 44 rex.R
3f: 24 .byte 0x24
***
KASAN: slab-use-after-free Read in region_del
tree: mm-new
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/akpm/mm.git
base: f50c6ce7bf30099042dac755fbd1e97da456f5ec
arch: amd64
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
config: https://ci.syzbot.org/builds/e716ec88-6c00-48e7-868d-3f4cb3999d4b/config
syz repro: https://ci.syzbot.org/findings/df3f89db-a2df-4664-973c-472164179e0a/syz_repro
==================================================================
BUG: KASAN: slab-use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
Read of size 1 at addr ffff888114425020 by task syz.2.313/6592
CPU: 0 UID: 0 PID: 6592 Comm: syz.2.313 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
__kasan_check_byte+0x2a/0x40 mm/kasan/common.c:574
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire+0x79/0x2e0 kernel/locking/lockdep.c:5842
__raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:341 [inline]
region_del+0xbe/0x950 mm/hugetlb.c:863
hugetlb_unreserve_pages+0xfa/0x230 mm/hugetlb.c:6757
remove_inode_hugepages+0x1036/0x11a0 fs/hugetlbfs/inode.c:613
hugetlbfs_evict_inode+0xaf/0x260 fs/hugetlbfs/inode.c:623
evict+0x61e/0xb10 fs/inode.c:841
__dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
finish_dput+0xc9/0x480 fs/dcache.c:879
do_one_tree fs/dcache.c:1657 [inline]
shrink_dcache_for_umount+0xe1/0x1f0 fs/dcache.c:1671
generic_shutdown_super+0x6f/0x2d0 fs/super.c:624
kill_anon_super+0x3b/0x70 fs/super.c:1292
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x69b/0x2320 kernel/exit.c:971
do_group_exit+0x21b/0x2d0 kernel/exit.c:1112
get_signal+0x1284/0x1330 kernel/signal.c:3034
arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6b41f9c799
Code: Unable to access opcode bytes at 0x7f6b41f9c76f.
RSP: 002b:00007f6b42db90e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f6b42215fa8 RCX: 00007f6b41f9c799
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6b42215fa8
RBP: 00007f6b42215fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6b42216038 R14: 00007ffd7b00f490 R15: 00007ffd7b00f578
</TASK>
Allocated by task 6005:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x31c/0x660 mm/slub.c:5339
kmalloc_noprof include/linux/slab.h:962 [inline]
resv_map_alloc+0x51/0x2c0 mm/hugetlb.c:1108
hugetlbfs_get_inode+0x5d/0x680 fs/hugetlbfs/inode.c:932
hugetlbfs_mknod fs/hugetlbfs/inode.c:987 [inline]
hugetlbfs_create+0x59/0xf0 fs/hugetlbfs/inode.c:1009
lookup_open fs/namei.c:4483 [inline]
open_last_lookups fs/namei.c:4583 [inline]
path_openat+0x1395/0x3860 fs/namei.c:4827
do_file_open+0x23e/0x4a0 fs/namei.c:4859
do_sys_openat2+0x113/0x200 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_creat fs/open.c:1450 [inline]
__se_sys_creat fs/open.c:1444 [inline]
__x64_sys_creat+0x8f/0xc0 fs/open.c:1444
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6005:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2687 [inline]
slab_free mm/slub.c:6124 [inline]
kfree+0x1c1/0x630 mm/slub.c:6442
hugetlbfs_evict_inode+0xe1/0x260 fs/hugetlbfs/inode.c:628
evict+0x61e/0xb10 fs/inode.c:841
__dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
shrink_kill+0xa9/0x2c0 fs/dcache.c:1147
shrink_dentry_list+0x2e0/0x5e0 fs/dcache.c:1174
shrink_dcache_tree+0xcf/0x310 fs/dcache.c:-1
do_one_tree fs/dcache.c:1654 [inline]
shrink_dcache_for_umount+0xa8/0x1f0 fs/dcache.c:1671
generic_shutdown_super+0x6f/0x2d0 fs/super.c:624
kill_anon_super+0x3b/0x70 fs/super.c:1292
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x69b/0x2320 kernel/exit.c:971
do_group_exit+0x21b/0x2d0 kernel/exit.c:1112
get_signal+0x1284/0x1330 kernel/signal.c:3034
arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888114425000
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 32 bytes inside of
freed 512-byte region [ffff888114425000, ffff888114425200)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888114424000 pfn:0x114424
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x17ff00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 017ff00000000240 ffff888100041c80 ffffea00044b8a10 ffffea0004539010
raw: ffff888114424000 0000000000100009 00000000f5000000 0000000000000000
head: 017ff00000000240 ffff888100041c80 ffffea00044b8a10 ffffea0004539010
head: ffff888114424000 0000000000100009 00000000f5000000 0000000000000000
head: 017ff00000000002 ffffea0004510901 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5267, tgid 5267 (udevd), ts 28927219244, free_ts 28922963584
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
alloc_slab_page mm/slub.c:3255 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3444
new_slab mm/slub.c:3502 [inline]
refill_objects+0x331/0x3c0 mm/slub.c:7134
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x2b9/0x620 mm/slub.c:4578
alloc_from_pcs mm/slub.c:4681 [inline]
slab_alloc_node mm/slub.c:4815 [inline]
__kmalloc_cache_noprof+0x392/0x660 mm/slub.c:5334
kmalloc_noprof include/linux/slab.h:962 [inline]
kzalloc_noprof include/linux/slab.h:1200 [inline]
kernfs_fop_open+0x397/0xca0 fs/kernfs/file.c:641
do_dentry_open+0x785/0x14e0 fs/open.c:949
vfs_open+0x3b/0x340 fs/open.c:1081
do_open fs/namei.c:4671 [inline]
path_openat+0x2e08/0x3860 fs/namei.c:4830
do_file_open+0x23e/0x4a0 fs/namei.c:4859
do_sys_openat2+0x113/0x200 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5265 tgid 5265 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
__slab_free+0x263/0x2b0 mm/slub.c:5532
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4501 [inline]
slab_alloc_node mm/slub.c:4830 [inline]
kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4837
lsm_inode_alloc security/security.c:228 [inline]
security_inode_alloc+0x39/0x310 security/security.c:1189
inode_init_always_gfp+0x9c8/0xda0 fs/inode.c:305
inode_init_always include/linux/fs.h:2925 [inline]
alloc_inode+0x82/0x1b0 fs/inode.c:352
iget_locked+0x131/0x6a0 fs/inode.c:1474
kernfs_get_inode+0x4f/0x780 fs/kernfs/inode.c:253
kernfs_iop_lookup+0x1fe/0x320 fs/kernfs/dir.c:1241
__lookup_slow+0x2b7/0x410 fs/namei.c:1916
lookup_slow+0x53/0x70 fs/namei.c:1933
walk_component fs/namei.c:2279 [inline]
lookup_last fs/namei.c:2780 [inline]
path_lookupat+0x3f5/0x8c0 fs/namei.c:2804
filename_lookup+0x256/0x5d0 fs/namei.c:2833
Memory state around the buggy address:
ffff888114424f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888114424f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888114425000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888114425080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888114425100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
***
general protection fault in mark_buffer_dirty_inode
tree: mm-new
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/akpm/mm.git
base: f50c6ce7bf30099042dac755fbd1e97da456f5ec
arch: amd64
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
config: https://ci.syzbot.org/builds/e716ec88-6c00-48e7-868d-3f4cb3999d4b/config
C repro: https://ci.syzbot.org/findings/670a21ca-1447-4fda-909b-5098c9c0cdd9/c_repro
syz repro: https://ci.syzbot.org/findings/670a21ca-1447-4fda-909b-5098c9c0cdd9/syz_repro
EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
ext4 filesystem being mounted at /0/mnt supports timestamps until 2038-01-19 (0x7fffffff)
fscrypt: AES-256-CBC-CTS using implementation "cts(cbc(ecb(aes-lib)))"
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 1 UID: 0 PID: 5946 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:kasan_byte_accessible+0x12/0x30 mm/kasan/generic.c:210
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 40 6a 80 09 cc 66 66 66 66 66 66 2e
RSP: 0018:ffffc90003c9f380 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffffff8bafae9e RCX: 0000000080000002
RDX: 0000000000000000 RSI: ffffffff8bafae9e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff2023057 R12: 0000000000000000
R13: 0000000000000018 R14: 0000000000000018 R15: 0000000000000001
FS: 0000555590824500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e763fff CR3: 000000016fa5e000 CR4: 00000000000006f0
Call Trace:
<TASK>
__kasan_check_byte+0x12/0x40 mm/kasan/common.c:573
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire+0x79/0x2e0 kernel/locking/lockdep.c:5842
__raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:341 [inline]
mark_buffer_dirty_inode+0xe3/0x2f0 fs/buffer.c:748
__ext4_handle_dirty_metadata+0x27a/0x810 fs/ext4/ext4_jbd2.c:393
ext4_xattr_block_set+0x24ff/0x2ad0 fs/ext4/xattr.c:2168
ext4_xattr_set_handle+0xe34/0x14c0 fs/ext4/xattr.c:2457
ext4_set_context+0x233/0x560 fs/ext4/crypto.c:166
fscrypt_set_context+0x397/0x460 fs/crypto/policy.c:791
__ext4_new_inode+0x3158/0x3d20 fs/ext4/ialloc.c:1314
ext4_symlink+0x3ac/0xb90 fs/ext4/namei.c:3386
vfs_symlink+0x195/0x340 fs/namei.c:5615
filename_symlinkat+0x1cd/0x410 fs/namei.c:5640
__do_sys_symlink fs/namei.c:5667 [inline]
__se_sys_symlink+0x4d/0x2b0 fs/namei.c:5663
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe222b9c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdf34afb88 EFLAGS: 00000246 ORIG_RAX: 0000000000000058
RAX: ffffffffffffffda RBX: 00007fe222e15fa0 RCX: 00007fe222b9c799
RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000200000000080
RBP: 00007fe222c32bd9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe222e15fac R14: 00007fe222e15fa0 R15: 00007fe222e15fa0
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:kasan_byte_accessible+0x12/0x30 mm/kasan/generic.c:210
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 40 6a 80 09 cc 66 66 66 66 66 66 2e
RSP: 0018:ffffc90003c9f380 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffffffff8bafae9e RCX: 0000000080000002
RDX: 0000000000000000 RSI: ffffffff8bafae9e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff2023057 R12: 0000000000000000
R13: 0000000000000018 R14: 0000000000000018 R15: 0000000000000001
FS: 0000555590824500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e763fff CR3: 000000016fa5e000 CR4: 00000000000006f0
----------------
Code disassembly (best guess), 4 bytes skipped:
0: 0f 1f 40 00 nopl 0x0(%rax)
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 0f 1f 40 d6 nopl -0x2a(%rax)
18: 48 c1 ef 03 shr $0x3,%rdi
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
* 26: 0f b6 04 07 movzbl (%rdi,%rax,1),%eax <-- trapping instruction
2a: 3c 08 cmp $0x8,%al
2c: 0f 92 c0 setb %al
2f: e9 40 6a 80 09 jmp 0x9806a74
34: cc int3
35: 66 data16
36: 66 data16
37: 66 data16
38: 66 data16
39: 66 data16
3a: 66 data16
3b: 2e cs
***
If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com
---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.
^ permalink raw reply
* Re: fscrypt API cleanups v3
From: Eric Biggers @ 2026-03-03 22:35 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Theodore Y. Ts'o, Jaegeuk Kim, Andreas Dilger, Chao Yu,
Christian Brauner, Darrick J. Wong, linux-fscrypt, linux-ext4,
linux-f2fs-devel, linux-fsdevel
In-Reply-To: <20260302141922.370070-1-hch@lst.de>
On Mon, Mar 02, 2026 at 06:18:05AM -0800, Christoph Hellwig wrote:
> Hi all,
>
> this series cleans up various fscrypt APIs to pass logical offsets in
> and lengths in bytes, and on-disk sectors as 512-byte sector units,
> like most of the VFS and block code.
>
> Changes since v2:
> - use the local bio variable in io_submit_init_bio
> - use folio instead of io_folio (and actually test the noinline mode,
> which should have cought this for the last round)
> - add an extra IS_ENABLED(CONFIG_FS_ENCRYPTION) to safeguard
> against potentially stupid compilers
> - document the byte length needs to be a multiple of the block
> size
> - case to u64 when passing the byte length
> - move a hunk to an earlier patch
> Changes since v1:
> - remove all buffer_head helpers, and do that before the API cleanups
> to simplify the series
> - fix a bisection hazard
> - spelling fixes in the commit logs
> - use "file position" to describe the byte offset into an inode
> - add another small ext4 cleanup at the end
This looks good now. I'll plan to apply this to fscrypt.git#for-next in
a bit. Other reviews and acks appreciated.
- Eric
^ permalink raw reply
* Re: [syzbot] [ext4?] kernel BUG in ext4_es_cache_extent (4)
From: syzbot @ 2026-03-03 19:19 UTC (permalink / raw)
To: adilger.kernel, linux-ext4, linux-kernel, ojaswin, syzkaller-bugs,
tytso
In-Reply-To: <6989419b.050a0220.3b3015.0065.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: af4e9ef3d784 uaccess: Fix scoped_user_read_access() for 'p..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13811b5a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=779072223d02a312
dashboard link: https://syzkaller.appspot.com/bug?extid=ccf1421545dbe5caa20c
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1620e552580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13810a02580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f6b75c8f432f/disk-af4e9ef3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4513ad566789/vmlinux-af4e9ef3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f7eea878db42/bzImage-af4e9ef3.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/8d81a7f0b7b8/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1351b006580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ccf1421545dbe5caa20c@syzkaller.appspotmail.com
EXT4-fs warning (device loop0): ext4_es_cache_extent:1082: inode #15: comm syz.0.36: ES cache extent failed: add [0,1,177,0x1] conflict with existing [0,1,113,0x2]
EXT4-fs warning (device loop0): ext4_es_cache_extent:1082: inode #15: comm syz.0.36: ES cache extent failed: add [1,15,177,0x1] conflict with existing [1,35,576460752303423487,0x18]
EXT4-fs warning (device loop0): ext4_es_cache_extent:1082: inode #15: comm syz.0.36: ES cache extent failed: add [16,1,177,0x1] conflict with existing [1,35,576460752303423487,0x18]
EXT4-fs warning (device loop0): ext4_es_cache_extent:1082: inode #15: comm syz.0.36: ES cache extent failed: add [17,10,177,0x1] conflict with existing [1,35,576460752303423487,0x18]
------------[ cut here ]------------
kernel BUG at fs/ext4/extents_status.c:1044!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 6062 Comm: syz.0.36 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:ext4_es_cache_extent+0x875/0x9e0 fs/ext4/extents_status.c:1044
Code: e1 07 80 c1 03 38 c1 0f 8c 5c fe ff ff 48 8b 7c 24 18 e8 fe ac ad ff e9 4d fe ff ff e8 a4 6e 43 ff 90 0f 0b e8 9c 6e 43 ff 90 <0f> 0b 65 8b 1d e6 98 99 10 bf 07 00 00 00 89 de e8 c6 72 43 ff 83
RSP: 0018:ffffc90003456d20 EFLAGS: 00010293
RAX: ffffffff82822744 RBX: 0000000000000018 RCX: ffff88803155bd00
RDX: 0000000000000000 RSI: 000000000000001b RDI: 0000000000000018
RBP: ffffc90003456e68 R08: ffffc90003456dd7 R09: ffffc90003456dc0
R10: dffffc0000000000 R11: fffff5200068adbb R12: ffffc90003456dc0
R13: 000000000000001b R14: 000000000000000f R15: dffffc0000000000
FS: 00007fbdae25d6c0(0000) GS:ffff888125464000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbdad3e9e80 CR3: 00000000781f0000 CR4: 0000000000350ef0
Call Trace:
<TASK>
ext4_cache_extents fs/ext4/extents.c:539 [inline]
__read_extent_tree_block+0x4b4/0x890 fs/ext4/extents.c:586
ext4_find_extent+0x76f/0xcc0 fs/ext4/extents.c:939
ext4_ext_map_blocks+0x283/0x58b0 fs/ext4/extents.c:4261
ext4_map_create_blocks+0x11d/0x540 fs/ext4/inode.c:616
ext4_map_blocks+0x7cd/0x11d0 fs/ext4/inode.c:809
_ext4_get_block+0x1e3/0x470 fs/ext4/inode.c:909
ext4_get_block_unwritten+0x2e/0x100 fs/ext4/inode.c:942
ext4_block_write_begin+0xb14/0x1950 fs/ext4/inode.c:1196
ext4_write_begin+0xb40/0x18c0 fs/ext4/ext4_jbd2.h:-1
ext4_da_write_begin+0x355/0xd80 fs/ext4/inode.c:3123
generic_perform_write+0x2e2/0x8f0 mm/filemap.c:4314
ext4_buffered_write_iter+0xce/0x3a0 fs/ext4/file.c:300
ext4_file_write_iter+0x298/0x1bf0 fs/ext4/file.c:-1
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_pwrite64 fs/read_write.c:795 [inline]
__do_sys_pwrite64 fs/read_write.c:803 [inline]
__se_sys_pwrite64 fs/read_write.c:800 [inline]
__x64_sys_pwrite64+0x199/0x230 fs/read_write.c:800
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbdad39c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbdae25d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007fbdad615fa0 RCX: 00007fbdad39c799
RDX: 00000000200000c1 RSI: 00002000000000c0 RDI: 0000000000000006
RBP: 00007fbdad432bd9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000009000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbdad616038 R14: 00007fbdad615fa0 R15: 00007fff33d9aaf8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_es_cache_extent+0x875/0x9e0 fs/ext4/extents_status.c:1044
Code: e1 07 80 c1 03 38 c1 0f 8c 5c fe ff ff 48 8b 7c 24 18 e8 fe ac ad ff e9 4d fe ff ff e8 a4 6e 43 ff 90 0f 0b e8 9c 6e 43 ff 90 <0f> 0b 65 8b 1d e6 98 99 10 bf 07 00 00 00 89 de e8 c6 72 43 ff 83
RSP: 0018:ffffc90003456d20 EFLAGS: 00010293
RAX: ffffffff82822744 RBX: 0000000000000018 RCX: ffff88803155bd00
RDX: 0000000000000000 RSI: 000000000000001b RDI: 0000000000000018
RBP: ffffc90003456e68 R08: ffffc90003456dd7 R09: ffffc90003456dc0
R10: dffffc0000000000 R11: fffff5200068adbb R12: ffffc90003456dc0
R13: 000000000000001b R14: 000000000000000f R15: dffffc0000000000
FS: 00007fbdae25d6c0(0000) GS:ffff888125464000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbdad3e9e80 CR3: 00000000781f0000 CR4: 0000000000350ef0
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply
* Re: [PATCH 1/1] filefrag: fix fibmap error message
From: Andreas Dilger @ 2026-03-03 18:38 UTC (permalink / raw)
To: David Timber; +Cc: linux-ext4
In-Reply-To: <20260303115637.453629-2-dxdt@dev.snart.me>
On Mar 3, 2026, at 04:55, David Timber <dxdt@dev.snart.me> wrote:
>
> When an errno other than EINVAL, ENOTTY or EPERM is returned from FIBMAP
> ioctl, the negative errno is passsed to strerror(), which only accepts
> positive errno values.
>
> Signed-off-by: David Timber <dxdt@dev.snart.me>
Reviewed-by: Andreas Dilger <adilger@dilger.ca <mailto:adilger@dilger.ca>>
> ---
> misc/filefrag.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/misc/filefrag.c b/misc/filefrag.c
> index 4641714c..d45288cd 100644
> --- a/misc/filefrag.c
> +++ b/misc/filefrag.c
> @@ -517,7 +517,7 @@ static int frag_report(const char *filename)
> filename);
> } else {
> fprintf(stderr, "%s: FIBMAP error: %s",
> - filename, strerror(expected));
> + filename, strerror(-expected));
> }
> rc = expected;
> goto out_close;
> --
> 2.53.0.1.ga224b40d3f.dirty
>
>
^ permalink raw reply
* Re: [PATCH v2] ext4: add sysfs attribute err_report_sec to control s_err_report timer
From: Darrick J. Wong @ 2026-03-03 18:37 UTC (permalink / raw)
To: Theodore Ts'o
Cc: adilger.kernel, Baolin Liu, linux-ext4, linux-kernel, Baolin Liu
In-Reply-To: <176962347637.1138505.16069919738430336386.b4-ty@mit.edu>
On Wed, Jan 28, 2026 at 01:05:03PM -0500, Theodore Ts'o wrote:
>
> On Thu, 11 Dec 2025 11:02:56 +0800, Baolin Liu wrote:
> > Add a new sysfs attribute "err_report_sec" to control the s_err_report
> > timer in ext4_sb_info. Writing '0' disables the timer, while writing
> > a non-zero value enables the timer and sets the timeout in seconds.
> >
> >
>
> Applied, thanks!
>
> [1/1] ext4: add sysfs attribute err_report_sec to control s_err_report timer
> commit: d518215c27194486fe13136a8dbbbabeefb5c9b6
Heh, thanks for adding this sysfs knob, now I have a userspace-visible
gadget for detecting fanotify IO error reporting support in ext4. :)
--D
> Best regards,
> --
> Theodore Ts'o <tytso@mit.edu>
>
^ permalink raw reply
* Re: [PATCH v4 2/2] jbd2: gracefully abort on transaction state corruptions
From: Andreas Dilger @ 2026-03-03 18:34 UTC (permalink / raw)
To: Milos Nikic; +Cc: jack, tytso, linux-ext4, linux-kernel
In-Reply-To: <20260303180157.53061-3-nikic.milos@gmail.com>
On Mar 3, 2026, at 11:01, Milos Nikic <nikic.milos@gmail.com> wrote:
>
> Auditing the jbd2 codebase reveals several legacy J_ASSERT calls
> that enforce internal state machine invariants (e.g., verifying
> jh->b_transaction or jh->b_next_transaction pointers).
>
> When these invariants are broken, the journal is in a corrupted
> state. However, triggering a fatal panic brings down the entire
> system for a localized filesystem error.
>
> This patch targets a specific class of these asserts: those
> residing inside functions that natively return integer error codes,
> booleans, or error pointers. It replaces the hard J_ASSERTs with
> WARN_ON_ONCE to capture the offending stack trace, safely drops
> any held locks, gracefully aborts the journal, and returns -EINVAL.
>
> This prevents a catastrophic kernel panic while ensuring the
> corrupted journal state is safely contained and upstream callers
> (like ext4 or ocfs2) can gracefully handle the aborted handle.
>
> Functions modified in fs/jbd2/transaction.c:
> - jbd2__journal_start()
> - do_get_write_access()
> - jbd2_journal_dirty_metadata()
> - jbd2_journal_forget()
> - jbd2_journal_try_to_free_buffers()
> - jbd2_journal_file_inode()
>
> Signed-off-by: Milos Nikic <nikic.milos@gmail.com>
Looks good, with one minor suggestion. Either way you could add:
Reviewed-by: Andreas Dilger <adilger@dilger.ca <mailto:adilger@dilger.ca>>
> @@ -1531,13 +1558,15 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
> spin_lock(&jh->b_state_lock);
> if (jh->b_transaction == transaction &&
> jh->b_jlist != BJ_Metadata)
> - pr_err("JBD2: assertion failure: h_type=%u "
> - "h_line_no=%u block_no=%llu jlist=%u\n",
> + pr_err("JBD2: assertion failure: h_type=%u h_line_no=%u block_no=%llu jlist=%u\n",
> handle->h_type, handle->h_line_no,
> (unsigned long long) bh->b_blocknr,
> jh->b_jlist);
> - J_ASSERT_JH(jh, jh->b_transaction != transaction ||
> - jh->b_jlist == BJ_Metadata);
> + if (WARN_ON_ONCE(jh->b_transaction == transaction &&
> + jh->b_jlist != BJ_Metadata)) {
> + ret = -EINVAL;
> + goto out_unlock_bh;
> + }
> spin_unlock(&jh->b_state_lock);
> }
It doesn't make sense to check these conditions twice. That was needed with
the J_ASSERT_JH() calls, but it is now possible to put the pr_err() calls
inside "if (WARN_ON_ONCE(...))" as it is done in other parts of the patch.
Cheers, Andreas
^ permalink raw reply
* Re: [PATCH v2 105/110] security: replace PRIino with %llu/%llx format strings
From: Casey Schaufler @ 2026-03-03 18:06 UTC (permalink / raw)
To: Jeff Layton, Alexander Viro, Christian Brauner, Jan Kara,
Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers, Dan Williams,
Matthew Wilcox, Eric Biggers, Theodore Y. Ts'o, Muchun Song,
Oscar Salvador, David Hildenbrand, David Howells, Paulo Alcantara,
Andreas Dilger, Jan Kara, Jaegeuk Kim, Chao Yu, Trond Myklebust,
Anna Schumaker, Chuck Lever, NeilBrown, Olga Kornievskaia,
Dai Ngo, Tom Talpey, Steve French, Ronnie Sahlberg,
Shyam Prasad N, Bharath SM, Alexander Aring, Ryusuke Konishi,
Viacheslav Dubeyko, Eric Van Hensbergen, Latchesar Ionkov,
Dominique Martinet, Christian Schoenebeck, David Sterba,
Marc Dionne, Ian Kent, Luis de Bethencourt, Salah Triki,
Tigran A. Aivazian, Ilya Dryomov, Alex Markuze, Jan Harkes, coda,
Nicolas Pitre, Tyler Hicks, Amir Goldstein, Christoph Hellwig,
John Paul Adrian Glaubitz, Yangtao Li, Mikulas Patocka,
David Woodhouse, Richard Weinberger, Dave Kleikamp,
Konstantin Komarov, Mark Fasheh, Joel Becker, Joseph Qi,
Mike Marshall, Martin Brandenburg, Miklos Szeredi, Anders Larsen,
Zhihao Cheng, Damien Le Moal, Naohiro Aota, Johannes Thumshirn,
John Johansen, Paul Moore, James Morris, Serge E. Hallyn,
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Fan Wu,
Stephen Smalley, Ondrej Mosnacek, Alex Deucher,
Christian König, David Airlie, Simona Vetter, Sumit Semwal,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
David S. Miller, Jakub Kicinski, Simon Horman, Oleg Nesterov,
Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, Darrick J. Wong,
Martin Schiller, Eric Paris, Joerg Reuter, Marcel Holtmann,
Johan Hedberg, Luiz Augusto von Dentz, Oliver Hartkopp,
Marc Kleine-Budde, David Ahern, Neal Cardwell, Steffen Klassert,
Herbert Xu, Remi Denis-Courmont, Marcelo Ricardo Leitner,
Xin Long, Magnus Karlsson, Maciej Fijalkowski, Stanislav Fomichev,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend
Cc: linux-fsdevel, linux-kernel, linux-trace-kernel, nvdimm, fsverity,
linux-mm, netfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs, samba-technical, linux-nilfs, v9fs, linux-afs, autofs,
ceph-devel, codalist, ecryptfs, linux-mtd, jfs-discussion, ntfs3,
ocfs2-devel, devel, linux-unionfs, apparmor,
linux-security-module, linux-integrity, selinux, amd-gfx,
dri-devel, linux-media, linaro-mm-sig, netdev, linux-perf-users,
linux-fscrypt, linux-xfs, linux-hams, linux-x25, audit,
linux-bluetooth, linux-can, linux-sctp, bpf
In-Reply-To: <20260302-iino-u64-v2-105-e5388800dae0@kernel.org>
On 3/2/2026 12:25 PM, Jeff Layton wrote:
> Now that i_ino is u64 and the PRIino format macro has been removed,
> replace all uses in security with the concrete format strings.
>
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
For the security/smack changes:
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
> ---
> security/apparmor/apparmorfs.c | 4 ++--
> security/integrity/integrity_audit.c | 2 +-
> security/ipe/audit.c | 2 +-
> security/lsm_audit.c | 10 +++++-----
> security/selinux/hooks.c | 10 +++++-----
> security/smack/smack_lsm.c | 12 ++++++------
> 6 files changed, 20 insertions(+), 20 deletions(-)
>
> diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
> index be343479f80b71566be6fda90fc4e00912faad63..7b645f40e71c956f216fa6a7d69c3ecd4e2a5ff4 100644
> --- a/security/apparmor/apparmorfs.c
> +++ b/security/apparmor/apparmorfs.c
> @@ -149,7 +149,7 @@ static int aafs_count;
>
> static int aafs_show_path(struct seq_file *seq, struct dentry *dentry)
> {
> - seq_printf(seq, "%s:[%" PRIino "u]", AAFS_NAME, d_inode(dentry)->i_ino);
> + seq_printf(seq, "%s:[%llu]", AAFS_NAME, d_inode(dentry)->i_ino);
> return 0;
> }
>
> @@ -2644,7 +2644,7 @@ static int policy_readlink(struct dentry *dentry, char __user *buffer,
> char name[32];
> int res;
>
> - res = snprintf(name, sizeof(name), "%s:[%" PRIino "u]", AAFS_NAME,
> + res = snprintf(name, sizeof(name), "%s:[%llu]", AAFS_NAME,
> d_inode(dentry)->i_ino);
> if (res > 0 && res < sizeof(name))
> res = readlink_copy(buffer, buflen, name, strlen(name));
> diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c
> index d28dac23a4e7cf651856b80ab7756d250187ccde..d8d9e5ff1cd22b091f462d1e83d28d2d6bd983e9 100644
> --- a/security/integrity/integrity_audit.c
> +++ b/security/integrity/integrity_audit.c
> @@ -62,7 +62,7 @@ void integrity_audit_message(int audit_msgno, struct inode *inode,
> if (inode) {
> audit_log_format(ab, " dev=");
> audit_log_untrustedstring(ab, inode->i_sb->s_id);
> - audit_log_format(ab, " ino=%" PRIino "u", inode->i_ino);
> + audit_log_format(ab, " ino=%llu", inode->i_ino);
> }
> audit_log_format(ab, " res=%d errno=%d", !result, errno);
> audit_log_end(ab);
> diff --git a/security/ipe/audit.c b/security/ipe/audit.c
> index 0de95dd4fbea15d4d913fc42e197c3120a9d24a0..93fb59fbddd60b56c0b22be2a38b809ef9e18b76 100644
> --- a/security/ipe/audit.c
> +++ b/security/ipe/audit.c
> @@ -153,7 +153,7 @@ void ipe_audit_match(const struct ipe_eval_ctx *const ctx,
> if (inode) {
> audit_log_format(ab, " dev=");
> audit_log_untrustedstring(ab, inode->i_sb->s_id);
> - audit_log_format(ab, " ino=%" PRIino "u", inode->i_ino);
> + audit_log_format(ab, " ino=%llu", inode->i_ino);
> } else {
> audit_log_format(ab, " dev=? ino=?");
> }
> diff --git a/security/lsm_audit.c b/security/lsm_audit.c
> index 523f2ee116f0f928003aec30a105d6d4ecb49b0b..737f5a263a8f79416133315edf363ece3d79c722 100644
> --- a/security/lsm_audit.c
> +++ b/security/lsm_audit.c
> @@ -202,7 +202,7 @@ void audit_log_lsm_data(struct audit_buffer *ab,
> if (inode) {
> audit_log_format(ab, " dev=");
> audit_log_untrustedstring(ab, inode->i_sb->s_id);
> - audit_log_format(ab, " ino=%" PRIino "u", inode->i_ino);
> + audit_log_format(ab, " ino=%llu", inode->i_ino);
> }
> break;
> }
> @@ -215,7 +215,7 @@ void audit_log_lsm_data(struct audit_buffer *ab,
> if (inode) {
> audit_log_format(ab, " dev=");
> audit_log_untrustedstring(ab, inode->i_sb->s_id);
> - audit_log_format(ab, " ino=%" PRIino "u", inode->i_ino);
> + audit_log_format(ab, " ino=%llu", inode->i_ino);
> }
> break;
> }
> @@ -228,7 +228,7 @@ void audit_log_lsm_data(struct audit_buffer *ab,
> if (inode) {
> audit_log_format(ab, " dev=");
> audit_log_untrustedstring(ab, inode->i_sb->s_id);
> - audit_log_format(ab, " ino=%" PRIino "u", inode->i_ino);
> + audit_log_format(ab, " ino=%llu", inode->i_ino);
> }
>
> audit_log_format(ab, " ioctlcmd=0x%hx", a->u.op->cmd);
> @@ -246,7 +246,7 @@ void audit_log_lsm_data(struct audit_buffer *ab,
> if (inode) {
> audit_log_format(ab, " dev=");
> audit_log_untrustedstring(ab, inode->i_sb->s_id);
> - audit_log_format(ab, " ino=%" PRIino "u", inode->i_ino);
> + audit_log_format(ab, " ino=%llu", inode->i_ino);
> }
> break;
> }
> @@ -265,7 +265,7 @@ void audit_log_lsm_data(struct audit_buffer *ab,
> }
> audit_log_format(ab, " dev=");
> audit_log_untrustedstring(ab, inode->i_sb->s_id);
> - audit_log_format(ab, " ino=%" PRIino "u", inode->i_ino);
> + audit_log_format(ab, " ino=%llu", inode->i_ino);
> rcu_read_unlock();
> break;
> }
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 9430f44c81447708c67ddc35c5b4254f16731b8f..8f38de4d223ea59cfea6bbe73747d7b228e0c33f 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -1400,7 +1400,7 @@ static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
> if (rc < 0) {
> kfree(context);
> if (rc != -ENODATA) {
> - pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%" PRIino "u\n",
> + pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%llu\n",
> __func__, -rc, inode->i_sb->s_id, inode->i_ino);
> return rc;
> }
> @@ -1412,13 +1412,13 @@ static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
> def_sid, GFP_NOFS);
> if (rc) {
> char *dev = inode->i_sb->s_id;
> - kino_t ino = inode->i_ino;
> + u64 ino = inode->i_ino;
>
> if (rc == -EINVAL) {
> - pr_notice_ratelimited("SELinux: inode=%" PRIino "u on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
> + pr_notice_ratelimited("SELinux: inode=%llu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
> ino, dev, context);
> } else {
> - pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%" PRIino "u\n",
> + pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%llu\n",
> __func__, context, -rc, dev, ino);
> }
> }
> @@ -3477,7 +3477,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
> &newsid);
> if (rc) {
> pr_err("SELinux: unable to map context to SID"
> - "for (%s, %" PRIino "u), rc=%d\n",
> + "for (%s, %llu), rc=%d\n",
> inode->i_sb->s_id, inode->i_ino, -rc);
> return;
> }
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 22b6bd322840c82697c38c07b19a4677e7da2598..2eb3368a3632b836df54ba8628c16f7215ddf3ea 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -182,7 +182,7 @@ static int smk_bu_inode(struct inode *inode, int mode, int rc)
> char acc[SMK_NUM_ACCESS_TYPE + 1];
>
> if (isp->smk_flags & SMK_INODE_IMPURE)
> - pr_info("Smack Unconfined Corruption: inode=(%s %" PRIino "u) %s\n",
> + pr_info("Smack Unconfined Corruption: inode=(%s %llu) %s\n",
> inode->i_sb->s_id, inode->i_ino, current->comm);
>
> if (rc <= 0)
> @@ -195,7 +195,7 @@ static int smk_bu_inode(struct inode *inode, int mode, int rc)
>
> smk_bu_mode(mode, acc);
>
> - pr_info("Smack %s: (%s %s %s) inode=(%s %" PRIino "u) %s\n", smk_bu_mess[rc],
> + pr_info("Smack %s: (%s %s %s) inode=(%s %llu) %s\n", smk_bu_mess[rc],
> tsp->smk_task->smk_known, isp->smk_inode->smk_known, acc,
> inode->i_sb->s_id, inode->i_ino, current->comm);
> return 0;
> @@ -214,7 +214,7 @@ static int smk_bu_file(struct file *file, int mode, int rc)
> char acc[SMK_NUM_ACCESS_TYPE + 1];
>
> if (isp->smk_flags & SMK_INODE_IMPURE)
> - pr_info("Smack Unconfined Corruption: inode=(%s %" PRIino "u) %s\n",
> + pr_info("Smack Unconfined Corruption: inode=(%s %llu) %s\n",
> inode->i_sb->s_id, inode->i_ino, current->comm);
>
> if (rc <= 0)
> @@ -223,7 +223,7 @@ static int smk_bu_file(struct file *file, int mode, int rc)
> rc = 0;
>
> smk_bu_mode(mode, acc);
> - pr_info("Smack %s: (%s %s %s) file=(%s %" PRIino "u %pD) %s\n", smk_bu_mess[rc],
> + pr_info("Smack %s: (%s %s %s) file=(%s %llu %pD) %s\n", smk_bu_mess[rc],
> sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
> inode->i_sb->s_id, inode->i_ino, file,
> current->comm);
> @@ -244,7 +244,7 @@ static int smk_bu_credfile(const struct cred *cred, struct file *file,
> char acc[SMK_NUM_ACCESS_TYPE + 1];
>
> if (isp->smk_flags & SMK_INODE_IMPURE)
> - pr_info("Smack Unconfined Corruption: inode=(%s %" PRIino "u) %s\n",
> + pr_info("Smack Unconfined Corruption: inode=(%s %llu) %s\n",
> inode->i_sb->s_id, inode->i_ino, current->comm);
>
> if (rc <= 0)
> @@ -253,7 +253,7 @@ static int smk_bu_credfile(const struct cred *cred, struct file *file,
> rc = 0;
>
> smk_bu_mode(mode, acc);
> - pr_info("Smack %s: (%s %s %s) file=(%s %" PRIino "u %pD) %s\n", smk_bu_mess[rc],
> + pr_info("Smack %s: (%s %s %s) file=(%s %llu %pD) %s\n", smk_bu_mess[rc],
> sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
> inode->i_sb->s_id, inode->i_ino, file,
> current->comm);
>
^ permalink raw reply
* [PATCH v4 2/2] jbd2: gracefully abort on transaction state corruptions
From: Milos Nikic @ 2026-03-03 18:01 UTC (permalink / raw)
To: jack; +Cc: tytso, linux-ext4, linux-kernel, Milos Nikic
In-Reply-To: <20260303180157.53061-1-nikic.milos@gmail.com>
Auditing the jbd2 codebase reveals several legacy J_ASSERT calls
that enforce internal state machine invariants (e.g., verifying
jh->b_transaction or jh->b_next_transaction pointers).
When these invariants are broken, the journal is in a corrupted
state. However, triggering a fatal panic brings down the entire
system for a localized filesystem error.
This patch targets a specific class of these asserts: those
residing inside functions that natively return integer error codes,
booleans, or error pointers. It replaces the hard J_ASSERTs with
WARN_ON_ONCE to capture the offending stack trace, safely drops
any held locks, gracefully aborts the journal, and returns -EINVAL.
This prevents a catastrophic kernel panic while ensuring the
corrupted journal state is safely contained and upstream callers
(like ext4 or ocfs2) can gracefully handle the aborted handle.
Functions modified in fs/jbd2/transaction.c:
- jbd2__journal_start()
- do_get_write_access()
- jbd2_journal_dirty_metadata()
- jbd2_journal_forget()
- jbd2_journal_try_to_free_buffers()
- jbd2_journal_file_inode()
Signed-off-by: Milos Nikic <nikic.milos@gmail.com>
---
fs/jbd2/transaction.c | 112 ++++++++++++++++++++++++++++++++----------
1 file changed, 86 insertions(+), 26 deletions(-)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 04d17a5f2a82..bae6c99d635c 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -474,7 +474,8 @@ handle_t *jbd2__journal_start(journal_t *journal, int nblocks, int rsv_blocks,
return ERR_PTR(-EROFS);
if (handle) {
- J_ASSERT(handle->h_transaction->t_journal == journal);
+ if (WARN_ON_ONCE(handle->h_transaction->t_journal != journal))
+ return ERR_PTR(-EINVAL);
handle->h_ref++;
return handle;
}
@@ -1036,7 +1037,13 @@ do_get_write_access(handle_t *handle, struct journal_head *jh,
*/
if (!jh->b_transaction) {
JBUFFER_TRACE(jh, "no transaction");
- J_ASSERT_JH(jh, !jh->b_next_transaction);
+ if (WARN_ON_ONCE(jh->b_next_transaction)) {
+ spin_unlock(&jh->b_state_lock);
+ unlock_buffer(bh);
+ error = -EINVAL;
+ jbd2_journal_abort(journal, error);
+ goto out;
+ }
JBUFFER_TRACE(jh, "file as BJ_Reserved");
/*
* Make sure all stores to jh (b_modified, b_frozen_data) are
@@ -1069,13 +1076,27 @@ do_get_write_access(handle_t *handle, struct journal_head *jh,
*/
if (jh->b_frozen_data) {
JBUFFER_TRACE(jh, "has frozen data");
- J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+ if (WARN_ON_ONCE(jh->b_next_transaction)) {
+ spin_unlock(&jh->b_state_lock);
+ error = -EINVAL;
+ jbd2_journal_abort(journal, error);
+ goto out;
+ }
goto attach_next;
}
JBUFFER_TRACE(jh, "owned by older transaction");
- J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
- J_ASSERT_JH(jh, jh->b_transaction == journal->j_committing_transaction);
+ if (WARN_ON_ONCE(jh->b_next_transaction ||
+ jh->b_transaction !=
+ journal->j_committing_transaction)) {
+ pr_err("JBD2: %s: assertion failure: b_next_transaction=%p b_transaction=%p j_committing_transaction=%p\n",
+ journal->j_devname, jh->b_next_transaction,
+ jh->b_transaction, journal->j_committing_transaction);
+ spin_unlock(&jh->b_state_lock);
+ error = -EINVAL;
+ jbd2_journal_abort(journal, error);
+ goto out;
+ }
/*
* There is one case we have to be very careful about. If the
@@ -1496,7 +1517,7 @@ void jbd2_buffer_abort_trigger(struct journal_head *jh,
int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
{
transaction_t *transaction = handle->h_transaction;
- journal_t *journal;
+ journal_t *journal = transaction->t_journal;
struct journal_head *jh;
int ret = 0;
@@ -1520,8 +1541,14 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
if (data_race(jh->b_transaction != transaction &&
jh->b_next_transaction != transaction)) {
spin_lock(&jh->b_state_lock);
- J_ASSERT_JH(jh, jh->b_transaction == transaction ||
- jh->b_next_transaction == transaction);
+ if (WARN_ON_ONCE(jh->b_transaction != transaction &&
+ jh->b_next_transaction != transaction)) {
+ pr_err("JBD2: %s: assertion failure: b_transaction=%p transaction=%p b_next_transaction=%p\n",
+ journal->j_devname, jh->b_transaction,
+ transaction, jh->b_next_transaction);
+ ret = -EINVAL;
+ goto out_unlock_bh;
+ }
spin_unlock(&jh->b_state_lock);
}
if (data_race(jh->b_modified == 1)) {
@@ -1531,13 +1558,15 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
spin_lock(&jh->b_state_lock);
if (jh->b_transaction == transaction &&
jh->b_jlist != BJ_Metadata)
- pr_err("JBD2: assertion failure: h_type=%u "
- "h_line_no=%u block_no=%llu jlist=%u\n",
+ pr_err("JBD2: assertion failure: h_type=%u h_line_no=%u block_no=%llu jlist=%u\n",
handle->h_type, handle->h_line_no,
(unsigned long long) bh->b_blocknr,
jh->b_jlist);
- J_ASSERT_JH(jh, jh->b_transaction != transaction ||
- jh->b_jlist == BJ_Metadata);
+ if (WARN_ON_ONCE(jh->b_transaction == transaction &&
+ jh->b_jlist != BJ_Metadata)) {
+ ret = -EINVAL;
+ goto out_unlock_bh;
+ }
spin_unlock(&jh->b_state_lock);
}
goto out;
@@ -1557,8 +1586,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
goto out_unlock_bh;
}
- journal = transaction->t_journal;
-
if (jh->b_modified == 0) {
/*
* This buffer's got modified and becoming part
@@ -1636,7 +1663,10 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
}
/* That test should have eliminated the following case: */
- J_ASSERT_JH(jh, jh->b_frozen_data == NULL);
+ if (WARN_ON_ONCE(jh->b_frozen_data)) {
+ ret = -EINVAL;
+ goto out_unlock_bh;
+ }
JBUFFER_TRACE(jh, "file as BJ_Metadata");
spin_lock(&journal->j_list_lock);
@@ -1675,6 +1705,7 @@ int jbd2_journal_forget(handle_t *handle, struct buffer_head *bh)
int err = 0;
int was_modified = 0;
int wait_for_writeback = 0;
+ int abort_journal = 0;
if (is_handle_aborted(handle))
return -EROFS;
@@ -1708,7 +1739,11 @@ int jbd2_journal_forget(handle_t *handle, struct buffer_head *bh)
jh->b_modified = 0;
if (jh->b_transaction == transaction) {
- J_ASSERT_JH(jh, !jh->b_frozen_data);
+ if (WARN_ON_ONCE(jh->b_frozen_data)) {
+ err = -EINVAL;
+ abort_journal = 1;
+ goto drop;
+ }
/* If we are forgetting a buffer which is already part
* of this transaction, then we can just drop it from
@@ -1747,8 +1782,11 @@ int jbd2_journal_forget(handle_t *handle, struct buffer_head *bh)
}
spin_unlock(&journal->j_list_lock);
} else if (jh->b_transaction) {
- J_ASSERT_JH(jh, (jh->b_transaction ==
- journal->j_committing_transaction));
+ if (WARN_ON_ONCE(jh->b_transaction != journal->j_committing_transaction)) {
+ err = -EINVAL;
+ abort_journal = 1;
+ goto drop;
+ }
/* However, if the buffer is still owned by a prior
* (committing) transaction, we can't drop it yet... */
JBUFFER_TRACE(jh, "belongs to older transaction");
@@ -1766,7 +1804,11 @@ int jbd2_journal_forget(handle_t *handle, struct buffer_head *bh)
jh->b_next_transaction = transaction;
spin_unlock(&journal->j_list_lock);
} else {
- J_ASSERT(jh->b_next_transaction == transaction);
+ if (WARN_ON_ONCE(jh->b_next_transaction != transaction)) {
+ err = -EINVAL;
+ abort_journal = 1;
+ goto drop;
+ }
/*
* only drop a reference if this transaction modified
@@ -1812,6 +1854,8 @@ int jbd2_journal_forget(handle_t *handle, struct buffer_head *bh)
drop:
__brelse(bh);
spin_unlock(&jh->b_state_lock);
+ if (abort_journal)
+ jbd2_journal_abort(journal, err);
if (wait_for_writeback)
wait_on_buffer(bh);
jbd2_journal_put_journal_head(jh);
@@ -2136,7 +2180,8 @@ bool jbd2_journal_try_to_free_buffers(journal_t *journal, struct folio *folio)
struct buffer_head *bh;
bool ret = false;
- J_ASSERT(folio_test_locked(folio));
+ if (WARN_ON_ONCE(!folio_test_locked(folio)))
+ return false;
head = folio_buffers(folio);
bh = head;
@@ -2651,6 +2696,8 @@ static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode,
{
transaction_t *transaction = handle->h_transaction;
journal_t *journal;
+ int err = 0;
+ int abort_transaction = 0;
if (is_handle_aborted(handle))
return -EROFS;
@@ -2685,20 +2732,33 @@ static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode,
/* On some different transaction's list - should be
* the committing one */
if (jinode->i_transaction) {
- J_ASSERT(jinode->i_next_transaction == NULL);
- J_ASSERT(jinode->i_transaction ==
- journal->j_committing_transaction);
+ if (WARN_ON_ONCE(jinode->i_next_transaction ||
+ jinode->i_transaction !=
+ journal->j_committing_transaction)) {
+ pr_err("JBD2: %s: assertion failure: i_next_transaction=%p i_transaction=%p j_committing_transaction=%p\n",
+ journal->j_devname, jinode->i_next_transaction,
+ jinode->i_transaction,
+ journal->j_committing_transaction);
+ err = -EINVAL;
+ abort_transaction = 1;
+ goto done;
+ }
jinode->i_next_transaction = transaction;
goto done;
}
/* Not on any transaction list... */
- J_ASSERT(!jinode->i_next_transaction);
+ if (WARN_ON_ONCE(jinode->i_next_transaction)) {
+ err = -EINVAL;
+ abort_transaction = 1;
+ goto done;
+ }
jinode->i_transaction = transaction;
list_add(&jinode->i_list, &transaction->t_inode_list);
done:
spin_unlock(&journal->j_list_lock);
-
- return 0;
+ if (abort_transaction)
+ jbd2_journal_abort(journal, err);
+ return err;
}
int jbd2_journal_inode_ranged_write(handle_t *handle,
--
2.53.0
^ permalink raw reply related
* [PATCH v4 1/2] jbd2: gracefully abort instead of panicking on unlocked buffer
From: Milos Nikic @ 2026-03-03 18:01 UTC (permalink / raw)
To: jack; +Cc: tytso, linux-ext4, linux-kernel, Milos Nikic, Zhang Yi,
Andreas Dilger
In-Reply-To: <20260303180157.53061-1-nikic.milos@gmail.com>
In jbd2_journal_get_create_access(), if the caller passes an unlocked
buffer, the code currently triggers a fatal J_ASSERT.
While an unlocked buffer here is a clear API violation and a bug in the
caller, crashing the entire system is an overly severe response. It brings
down the whole machine for a localized filesystem inconsistency.
Replace the J_ASSERT with a WARN_ON_ONCE to capture the offending caller's
stack trace, and return an error (-EINVAL). This allows the journal to
gracefully abort the transaction, protecting data integrity without
causing a kernel panic.
Signed-off-by: Milos Nikic <nikic.milos@gmail.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
---
fs/jbd2/transaction.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index dca4b5d8aaaa..04d17a5f2a82 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1302,7 +1302,12 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
goto out;
}
- J_ASSERT_JH(jh, buffer_locked(jh2bh(jh)));
+ if (WARN_ON_ONCE(!buffer_locked(jh2bh(jh)))) {
+ err = -EINVAL;
+ spin_unlock(&jh->b_state_lock);
+ jbd2_journal_abort(journal, err);
+ goto out;
+ }
if (jh->b_transaction == NULL) {
/*
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox