Re: [PATCH 3/3] md: Remove the last use of page_buffers()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Memory leak of bitmap pages in `free_buffers()` when unmapping an internal block-device bitmap or on error paths for file-backed bitmaps.
--

commit 5c27b3beb1da589c8d8b3b4113d43873e56ed7da
Author: Matthew Wilcox (Oracle) <willy@infradead.org>

md: Remove the last use of page_buffers()

This commit converts the page to a folio in write_file_page() and uses
folio_buffers() instead of page_buffers(). This change prepares the
md-bitmap codebase for a later conversion from pages to folios.

> diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
> index 7b42db87d536d..c2528220c406d 100644
> --- a/drivers/md/md-bitmap.c
> +++ b/drivers/md/md-bitmap.c
> @@ -516,7 +516,8 @@ static void end_bitmap_write(struct bio *bio)
>  
>  static void write_file_page(struct bitmap *bitmap, struct page *page, int wait)
>  {
> -	struct buffer_head *bh = page_buffers(page);
> +	struct folio *folio = page_folio(page);
> +	struct buffer_head *bh = folio_buffers(folio);

[Severity: High]
This is a pre-existing issue, but since this code is being converted to use
folios, does free_buffers() leak the folio when unmapping an internal
block-device bitmap or on error paths for file-backed bitmaps?

In md_bitmap_storage_alloc(), memory for store->filemap is allocated using
alloc_page(), which sets the baseline refcount to 1. For internal
block-device bitmaps, the pages are read using read_sb_page() which does
not attach buffer_head structures or set the folio private flag.

During array teardown, md_bitmap_file_unmap() iterates over store->filemap
and calls free_buffers():

static void free_buffers(struct page *page)
{
	struct folio *folio = page_folio(page);
	struct buffer_head *bh = folio_detach_private(folio);

	if (!bh)
		return;
...
	folio_put(folio);
}

Since folio_detach_private() returns NULL here, the early return skips the
final folio_put(). Over time, this could accumulate to megabytes of leaked
memory if an administrator repeatedly starts and stops md arrays with
internal bitmaps.

Could this early return be updated to ensure the folio reference is properly
dropped even when there are no buffers attached?

>  
>  	while (bh && bh->b_blocknr) {
>  		atomic_inc(&bitmap->pending_writes);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913-remove-pg_private-v4-0-848550f7574e@nvidia.com?part=3