Linux-mtd Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Tal Zussman" <tz2294@columbia.edu>,
	"Joern Engel" <joern@lazybastard.org>,
	"Miquel Raynal" <miquel.raynal@bootlin.com>,
	"Richard Weinberger" <richard@nod.at>,
	"Vignesh Raghavendra" <vigneshr@ti.com>
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>,
	linux-mtd@lists.infradead.org
Subject: Re: [PATCH 3/3] mtd: block2mtd: convert _block2mtd_erase() to folios
Date: Thu, 15 Oct 2026 03:45:56 +0000	[thread overview]
Message-ID: <sashiko-outbox-172225@kernel.org> (raw)
In-Reply-To: <20261014-block2mtd-folio-v1-3-19d24ae676ee@columbia.edu>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] mm: missing folio->mapping re-validation after folio_lock()
--

commit 5d3ba379c345de78b1eb892e6685b2e8f75987f5
Author: Tal Zussman <tz2294@columbia.edu>

mtd: block2mtd: convert _block2mtd_erase() to folios

Erase through a folio instead of a page, and use memchr_inv() to check
whether a range still needs erasing instead of the open-coded scan.
This removes four hidden compound_head() calls per page, and the last
user of page_read(), so remove that too.

> diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
> index 910669d6bb943..a1d24fef415dd 100644
> --- a/drivers/mtd/devices/block2mtd.c
> +++ b/drivers/mtd/devices/block2mtd.c
[ ... ]
>  /* erase a specified part of the device */
>  static int _block2mtd_erase(struct block2mtd_dev *dev, loff_t to, size_t len)
>  {
>  	struct address_space *mapping = dev->bdev_file->f_mapping;
[ ... ]
> +	while (len) {
> +		folio = read_mapping_folio(mapping, to >> PAGE_SHIFT, NULL);
> +		if (IS_ERR(folio))
> +			return PTR_ERR(folio);
> +
> +		offset = offset_in_folio(folio, to);
> +		chunk = min(len, folio_size(folio) - offset);
> +		p = folio_address(folio) + offset;
> +		if (memchr_inv(p, 0xff, chunk)) {
> +			folio_lock(folio);
> +			memset(p, 0xff, chunk);
> +			folio_mark_dirty(folio);
> +			folio_unlock(folio);

[Severity: Medium]
Could _block2mtd_erase() modify a truncated folio here?

If the folio is truncated from the page cache while waiting for folio_lock(),
we could proceed with modifying the memory without it ever being written back
to the device. Should this re-validate that folio->mapping == mapping after
acquiring the lock?

> +			balance_dirty_pages_ratelimited(mapping);
> +		}
> +		folio_put(folio);
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014-block2mtd-folio-v1-0-19d24ae676ee@columbia.edu?part=3

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

  reply	other threads:[~2026-10-15  3:46 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-15  3:34 [PATCH 0/3] mtd: block2mtd: convert to folios Tal Zussman
2026-10-15  3:34 ` [PATCH 1/3] mtd: block2mtd: convert block2mtd_read() " Tal Zussman
2026-10-15  3:34 ` [PATCH 2/3] mtd: block2mtd: convert _block2mtd_write() " Tal Zussman
2026-10-15  3:34 ` [PATCH 3/3] mtd: block2mtd: convert _block2mtd_erase() " Tal Zussman
2026-10-15  3:45   ` sashiko-bot [this message]
2026-10-15  9:14     ` Miquel Raynal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=sashiko-outbox-172225@kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=joern@lazybastard.org \
    --cc=linux-mtd@lists.infradead.org \
    --cc=miquel.raynal@bootlin.com \
    --cc=richard@nod.at \
    --cc=sashiko-reviews@lists.linux.dev \
    --cc=tz2294@columbia.edu \
    --cc=vigneshr@ti.com \
    --cc=willy@infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox