* [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks
@ 2025-11-04 12:50 Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 2/5] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector Yongpeng Yang
` (5 more replies)
0 siblings, 6 replies; 9+ messages in thread
From: Yongpeng Yang @ 2025-11-04 12:50 UTC (permalink / raw)
To: Namjae Jeon, Sungjong Seo, OGAWA Hirofumi, Jan Kara,
Carlos Maiolino, Jens Axboe, Greg Kroah-Hartman, Sasha Levin,
Alexander Viro, Christian Brauner, Christoph Hellwig
Cc: linux-xfs, linux-fsdevel, linux-block, stable, Matthew Wilcox,
Darrick J . Wong, Yongpeng Yang, Christoph Hellwig
From: Yongpeng Yang <yangyongpeng@xiaomi.com>
When emulating an nvme device on qemu with both logical_block_size and
physical_block_size set to 8 KiB, but without format, a kernel panic
was triggered during the early boot stage while attempting to mount a
vfat filesystem.
[95553.682035] EXT4-fs (nvme0n1): unable to set blocksize
[95553.684326] EXT4-fs (nvme0n1): unable to set blocksize
[95553.686501] EXT4-fs (nvme0n1): unable to set blocksize
[95553.696448] ISOFS: unsupported/invalid hardware sector size 8192
[95553.697117] ------------[ cut here ]------------
[95553.697567] kernel BUG at fs/buffer.c:1582!
[95553.697984] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[95553.698602] CPU: 0 UID: 0 PID: 7212 Comm: mount Kdump: loaded Not tainted 6.18.0-rc2+ #38 PREEMPT(voluntary)
[95553.699511] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[95553.700534] RIP: 0010:folio_alloc_buffers+0x1bb/0x1c0
[95553.701018] Code: 48 8b 15 e8 93 18 02 65 48 89 35 e0 93 18 02 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 90 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f
[95553.702648] RSP: 0018:ffffd1b0c676f990 EFLAGS: 00010246
[95553.703132] RAX: ffff8cfc4176d820 RBX: 0000000000508c48 RCX: 0000000000000001
[95553.703805] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 0000000000000000
[95553.704481] RBP: ffffd1b0c676f9c8 R08: 0000000000000000 R09: 0000000000000000
[95553.705148] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
[95553.705816] R13: 0000000000002000 R14: fffff8bc8257e800 R15: 0000000000000000
[95553.706483] FS: 000072ee77315840(0000) GS:ffff8cfdd2c8d000(0000) knlGS:0000000000000000
[95553.707248] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[95553.707782] CR2: 00007d8f2a9e5a20 CR3: 0000000039d0c006 CR4: 0000000000772ef0
[95553.708439] PKRU: 55555554
[95553.708734] Call Trace:
[95553.709015] <TASK>
[95553.709266] __getblk_slow+0xd2/0x230
[95553.709641] ? find_get_block_common+0x8b/0x530
[95553.710084] bdev_getblk+0x77/0xa0
[95553.710449] __bread_gfp+0x22/0x140
[95553.710810] fat_fill_super+0x23a/0xfc0
[95553.711216] ? __pfx_setup+0x10/0x10
[95553.711580] ? __pfx_vfat_fill_super+0x10/0x10
[95553.712014] vfat_fill_super+0x15/0x30
[95553.712401] get_tree_bdev_flags+0x141/0x1e0
[95553.712817] get_tree_bdev+0x10/0x20
[95553.713177] vfat_get_tree+0x15/0x20
[95553.713550] vfs_get_tree+0x2a/0x100
[95553.713910] vfs_cmd_create+0x62/0xf0
[95553.714273] __do_sys_fsconfig+0x4e7/0x660
[95553.714669] __x64_sys_fsconfig+0x20/0x40
[95553.715062] x64_sys_call+0x21ee/0x26a0
[95553.715453] do_syscall_64+0x80/0x670
[95553.715816] ? __fs_parse+0x65/0x1e0
[95553.716172] ? fat_parse_param+0x103/0x4b0
[95553.716587] ? vfs_parse_fs_param_source+0x21/0xa0
[95553.717034] ? __do_sys_fsconfig+0x3d9/0x660
[95553.717548] ? __x64_sys_fsconfig+0x20/0x40
[95553.717957] ? x64_sys_call+0x21ee/0x26a0
[95553.718360] ? do_syscall_64+0xb8/0x670
[95553.718734] ? __x64_sys_fsconfig+0x20/0x40
[95553.719141] ? x64_sys_call+0x21ee/0x26a0
[95553.719545] ? do_syscall_64+0xb8/0x670
[95553.719922] ? x64_sys_call+0x1405/0x26a0
[95553.720317] ? do_syscall_64+0xb8/0x670
[95553.720702] ? __x64_sys_close+0x3e/0x90
[95553.721080] ? x64_sys_call+0x1b5e/0x26a0
[95553.721478] ? do_syscall_64+0xb8/0x670
[95553.721841] ? irqentry_exit+0x43/0x50
[95553.722211] ? exc_page_fault+0x90/0x1b0
[95553.722681] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[95553.723166] RIP: 0033:0x72ee774f3afe
[95553.723562] Code: 73 01 c3 48 8b 0d 0a 33 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 49 89 ca b8 af 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d da 32 0f 00 f7 d8 64 89 01 48
[95553.725188] RSP: 002b:00007ffe97148978 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
[95553.725892] RAX: ffffffffffffffda RBX: 00005dcfe53d0080 RCX: 000072ee774f3afe
[95553.726526] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003
[95553.727176] RBP: 00007ffe97148ac0 R08: 0000000000000000 R09: 000072ee775e7ac0
[95553.727818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[95553.728459] R13: 00005dcfe53d04b0 R14: 000072ee77670b00 R15: 00005dcfe53d1a28
[95553.729086] </TASK>
The panic occurs as follows:
1. logical_block_size is 8KiB, causing {struct super_block *sb}->s_blocksize
is initialized to 0.
vfat_fill_super
- fat_fill_super
- sb_min_blocksize
- sb_set_blocksize //return 0 when size is 8KiB.
2. __bread_gfp is called with size == 0, causing folio_alloc_buffers() to
compute an offset equal to folio_size(folio), which triggers a BUG_ON.
fat_fill_super
- sb_bread
- __bread_gfp // size == {struct super_block *sb}->s_blocksize == 0
- bdev_getblk
- __getblk_slow
- grow_buffers
- grow_dev_folio
- folio_alloc_buffers // size == 0
- folio_set_bh //offset == folio_size(folio) and panic
To fix this issue, add proper return value checks for
sb_min_blocksize().
Cc: <stable@vger.kernel.org> # v6.15
Fixes: a64e5a596067bd ("bdev: add back PAGE_SIZE block size validation for sb_set_blocksize()")
Reviewed-by: Matthew Wilcox <willy@infradead.org>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
---
v6:
- fix 'Fixes tag' format error
- drop the pointless extern and spell out the parameter of
sb_set_blocksize and sb_set_blocksize
v5:
- add cc tag for 5th patch
v4:
- split the changes into 5 patches
v3:
- remove the unnecessary blocksize variable definition
v2:
- add the __must_check mark to sb_min_blocksize() and include the Fixes
tag
---
fs/fat/inode.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 9648ed097816..9cfe20a3daaf 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1595,8 +1595,12 @@ int fat_fill_super(struct super_block *sb, struct fs_context *fc,
setup(sb); /* flavour-specific stuff that needs options */
+ error = -EINVAL;
+ if (!sb_min_blocksize(sb, 512)) {
+ fat_msg(sb, KERN_ERR, "unable to set blocksize");
+ goto out_fail;
+ }
error = -EIO;
- sb_min_blocksize(sb, 512);
bh = sb_bread(sb, 0);
if (bh == NULL) {
fat_msg(sb, KERN_ERR, "unable to read boot sector");
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH v6 2/5] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
2025-11-04 12:50 [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks Yongpeng Yang
@ 2025-11-04 12:50 ` Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 3/5] isofs: check the return value of sb_min_blocksize() in isofs_fill_super Yongpeng Yang
` (4 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Yongpeng Yang @ 2025-11-04 12:50 UTC (permalink / raw)
To: Namjae Jeon, Sungjong Seo, OGAWA Hirofumi, Jan Kara,
Carlos Maiolino, Jens Axboe, Greg Kroah-Hartman, Sasha Levin,
Alexander Viro, Christian Brauner, Christoph Hellwig
Cc: linux-xfs, linux-fsdevel, linux-block, stable, Matthew Wilcox,
Darrick J . Wong, Yongpeng Yang, Christoph Hellwig
From: Yongpeng Yang <yangyongpeng@xiaomi.com>
sb_min_blocksize() may return 0. Check its return value to avoid
accessing the filesystem super block when sb->s_blocksize is 0.
Cc: <stable@vger.kernel.org> # v6.15
Fixes: 719c1e1829166d ("exfat: add super block operations")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
---
fs/exfat/super.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/exfat/super.c b/fs/exfat/super.c
index 7f9592856bf7..74d451f732c7 100644
--- a/fs/exfat/super.c
+++ b/fs/exfat/super.c
@@ -433,7 +433,10 @@ static int exfat_read_boot_sector(struct super_block *sb)
struct exfat_sb_info *sbi = EXFAT_SB(sb);
/* set block size to read super block */
- sb_min_blocksize(sb, 512);
+ if (!sb_min_blocksize(sb, 512)) {
+ exfat_err(sb, "unable to set blocksize");
+ return -EINVAL;
+ }
/* read boot sector */
sbi->boot_bh = sb_bread(sb, 0);
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH v6 3/5] isofs: check the return value of sb_min_blocksize() in isofs_fill_super
2025-11-04 12:50 [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 2/5] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector Yongpeng Yang
@ 2025-11-04 12:50 ` Yongpeng Yang
2025-11-04 21:29 ` Damien Le Moal
2025-11-04 12:50 ` [PATCH v6 4/5] xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super Yongpeng Yang
` (3 subsequent siblings)
5 siblings, 1 reply; 9+ messages in thread
From: Yongpeng Yang @ 2025-11-04 12:50 UTC (permalink / raw)
To: Namjae Jeon, Sungjong Seo, OGAWA Hirofumi, Jan Kara,
Carlos Maiolino, Jens Axboe, Greg Kroah-Hartman, Sasha Levin,
Alexander Viro, Christian Brauner, Christoph Hellwig
Cc: linux-xfs, linux-fsdevel, linux-block, stable, Matthew Wilcox,
Darrick J . Wong, Yongpeng Yang, Christoph Hellwig
From: Yongpeng Yang <yangyongpeng@xiaomi.com>
sb_min_blocksize() may return 0. Check its return value to avoid
opt->blocksize and sb->s_blocksize is 0.
Cc: <stable@vger.kernel.org> # v6.15
Fixes: 1b17a46c9243e9 ("isofs: convert isofs to use the new mount API")
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
---
fs/isofs/inode.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 6f0e6b19383c..ad3143d4066b 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -610,6 +610,11 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc)
goto out_freesbi;
}
opt->blocksize = sb_min_blocksize(s, opt->blocksize);
+ if (!opt->blocksize) {
+ printk(KERN_ERR
+ "ISOFS: unable to set blocksize\n");
+ goto out_freesbi;
+ }
sbi->s_high_sierra = 0; /* default is iso9660 */
sbi->s_session = opt->session;
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH v6 4/5] xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super
2025-11-04 12:50 [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 2/5] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 3/5] isofs: check the return value of sb_min_blocksize() in isofs_fill_super Yongpeng Yang
@ 2025-11-04 12:50 ` Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 5/5] block: add __must_check attribute to sb_min_blocksize() Yongpeng Yang
` (2 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Yongpeng Yang @ 2025-11-04 12:50 UTC (permalink / raw)
To: Namjae Jeon, Sungjong Seo, OGAWA Hirofumi, Jan Kara,
Carlos Maiolino, Jens Axboe, Greg Kroah-Hartman, Sasha Levin,
Alexander Viro, Christian Brauner, Christoph Hellwig
Cc: linux-xfs, linux-fsdevel, linux-block, stable, Matthew Wilcox,
Darrick J . Wong, Yongpeng Yang, Christoph Hellwig
From: Yongpeng Yang <yangyongpeng@xiaomi.com>
sb_min_blocksize() may return 0. Check its return value to avoid the
filesystem super block when sb->s_blocksize is 0.
Cc: <stable@vger.kernel.org> # v6.15
Fixes: a64e5a596067bd ("bdev: add back PAGE_SIZE block size validation for sb_set_blocksize()")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
---
fs/xfs/xfs_super.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index e85a156dc17d..fbb8009f1c0f 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1662,7 +1662,10 @@ xfs_fs_fill_super(
if (error)
return error;
- sb_min_blocksize(sb, BBSIZE);
+ if (!sb_min_blocksize(sb, BBSIZE)) {
+ xfs_err(mp, "unable to set blocksize");
+ return -EINVAL;
+ }
sb->s_xattr = xfs_xattr_handlers;
sb->s_export_op = &xfs_export_operations;
#ifdef CONFIG_XFS_QUOTA
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH v6 5/5] block: add __must_check attribute to sb_min_blocksize()
2025-11-04 12:50 [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks Yongpeng Yang
` (2 preceding siblings ...)
2025-11-04 12:50 ` [PATCH v6 4/5] xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super Yongpeng Yang
@ 2025-11-04 12:50 ` Yongpeng Yang
2025-11-04 17:00 ` [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks OGAWA Hirofumi
2025-11-05 11:17 ` Christian Brauner
5 siblings, 0 replies; 9+ messages in thread
From: Yongpeng Yang @ 2025-11-04 12:50 UTC (permalink / raw)
To: Namjae Jeon, Sungjong Seo, OGAWA Hirofumi, Jan Kara,
Carlos Maiolino, Jens Axboe, Greg Kroah-Hartman, Sasha Levin,
Alexander Viro, Christian Brauner, Christoph Hellwig
Cc: linux-xfs, linux-fsdevel, linux-block, stable, Matthew Wilcox,
Darrick J . Wong, Yongpeng Yang, Christoph Hellwig
From: Yongpeng Yang <yangyongpeng@xiaomi.com>
When sb_min_blocksize() returns 0 and the return value is not checked,
it may lead to a situation where sb->s_blocksize is 0 when
accessing the filesystem super block. After commit a64e5a596067bd
("bdev: add back PAGE_SIZE block size validation for
sb_set_blocksize()"), this becomes more likely to happen when the
block device’s logical_block_size is larger than PAGE_SIZE and the
filesystem is unformatted. Add the __must_check attribute to ensure
callers always check the return value.
Cc: <stable@vger.kernel.org> # v6.15
Suggested-by: Matthew Wilcox <willy@infradead.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
---
block/bdev.c | 2 +-
include/linux/fs.h | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/block/bdev.c b/block/bdev.c
index 810707cca970..638f0cd458ae 100644
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -231,7 +231,7 @@ int sb_set_blocksize(struct super_block *sb, int size)
EXPORT_SYMBOL(sb_set_blocksize);
-int sb_min_blocksize(struct super_block *sb, int size)
+int __must_check sb_min_blocksize(struct super_block *sb, int size)
{
int minsize = bdev_logical_block_size(sb->s_bdev);
if (size < minsize)
diff --git a/include/linux/fs.h b/include/linux/fs.h
index c895146c1444..3ea98c6cce81 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -3423,8 +3423,8 @@ static inline void remove_inode_hash(struct inode *inode)
extern void inode_sb_list_add(struct inode *inode);
extern void inode_add_lru(struct inode *inode);
-extern int sb_set_blocksize(struct super_block *, int);
-extern int sb_min_blocksize(struct super_block *, int);
+int sb_set_blocksize(struct super_block *sb, int size);
+int __must_check sb_min_blocksize(struct super_block *sb, int size);
int generic_file_mmap(struct file *, struct vm_area_struct *);
int generic_file_mmap_prepare(struct vm_area_desc *desc);
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks
2025-11-04 12:50 [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks Yongpeng Yang
` (3 preceding siblings ...)
2025-11-04 12:50 ` [PATCH v6 5/5] block: add __must_check attribute to sb_min_blocksize() Yongpeng Yang
@ 2025-11-04 17:00 ` OGAWA Hirofumi
2025-11-05 11:17 ` Christian Brauner
5 siblings, 0 replies; 9+ messages in thread
From: OGAWA Hirofumi @ 2025-11-04 17:00 UTC (permalink / raw)
To: Andrew Morton
Cc: Yongpeng Yang, Namjae Jeon, Sungjong Seo, Jan Kara,
Carlos Maiolino, Jens Axboe, Greg Kroah-Hartman, Sasha Levin,
Alexander Viro, Christian Brauner, Christoph Hellwig, linux-xfs,
linux-fsdevel, linux-block, stable, Matthew Wilcox,
Darrick J . Wong, Yongpeng Yang, Christoph Hellwig
Yongpeng Yang <yangyongpeng.storage@gmail.com> writes:
> From: Yongpeng Yang <yangyongpeng@xiaomi.com>
>
> When emulating an nvme device on qemu with both logical_block_size and
> physical_block_size set to 8 KiB, but without format, a kernel panic
> was triggered during the early boot stage while attempting to mount a
> vfat filesystem.
>
> [95553.682035] EXT4-fs (nvme0n1): unable to set blocksize
> [95553.684326] EXT4-fs (nvme0n1): unable to set blocksize
> [95553.686501] EXT4-fs (nvme0n1): unable to set blocksize
> [95553.696448] ISOFS: unsupported/invalid hardware sector size 8192
> [95553.697117] ------------[ cut here ]------------
> [95553.697567] kernel BUG at fs/buffer.c:1582!
> [95553.697984] Oops: invalid opcode: 0000 [#1] SMP NOPTI
> [95553.698602] CPU: 0 UID: 0 PID: 7212 Comm: mount Kdump: loaded Not tainted 6.18.0-rc2+ #38 PREEMPT(voluntary)
> [95553.699511] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
> [95553.700534] RIP: 0010:folio_alloc_buffers+0x1bb/0x1c0
> [95553.701018] Code: 48 8b 15 e8 93 18 02 65 48 89 35 e0 93 18 02 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 90 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f
> [95553.702648] RSP: 0018:ffffd1b0c676f990 EFLAGS: 00010246
> [95553.703132] RAX: ffff8cfc4176d820 RBX: 0000000000508c48 RCX: 0000000000000001
> [95553.703805] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 0000000000000000
> [95553.704481] RBP: ffffd1b0c676f9c8 R08: 0000000000000000 R09: 0000000000000000
> [95553.705148] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
> [95553.705816] R13: 0000000000002000 R14: fffff8bc8257e800 R15: 0000000000000000
> [95553.706483] FS: 000072ee77315840(0000) GS:ffff8cfdd2c8d000(0000) knlGS:0000000000000000
> [95553.707248] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [95553.707782] CR2: 00007d8f2a9e5a20 CR3: 0000000039d0c006 CR4: 0000000000772ef0
> [95553.708439] PKRU: 55555554
> [95553.708734] Call Trace:
> [95553.709015] <TASK>
> [95553.709266] __getblk_slow+0xd2/0x230
> [95553.709641] ? find_get_block_common+0x8b/0x530
> [95553.710084] bdev_getblk+0x77/0xa0
> [95553.710449] __bread_gfp+0x22/0x140
> [95553.710810] fat_fill_super+0x23a/0xfc0
> [95553.711216] ? __pfx_setup+0x10/0x10
> [95553.711580] ? __pfx_vfat_fill_super+0x10/0x10
> [95553.712014] vfat_fill_super+0x15/0x30
> [95553.712401] get_tree_bdev_flags+0x141/0x1e0
> [95553.712817] get_tree_bdev+0x10/0x20
> [95553.713177] vfat_get_tree+0x15/0x20
> [95553.713550] vfs_get_tree+0x2a/0x100
> [95553.713910] vfs_cmd_create+0x62/0xf0
> [95553.714273] __do_sys_fsconfig+0x4e7/0x660
> [95553.714669] __x64_sys_fsconfig+0x20/0x40
> [95553.715062] x64_sys_call+0x21ee/0x26a0
> [95553.715453] do_syscall_64+0x80/0x670
> [95553.715816] ? __fs_parse+0x65/0x1e0
> [95553.716172] ? fat_parse_param+0x103/0x4b0
> [95553.716587] ? vfs_parse_fs_param_source+0x21/0xa0
> [95553.717034] ? __do_sys_fsconfig+0x3d9/0x660
> [95553.717548] ? __x64_sys_fsconfig+0x20/0x40
> [95553.717957] ? x64_sys_call+0x21ee/0x26a0
> [95553.718360] ? do_syscall_64+0xb8/0x670
> [95553.718734] ? __x64_sys_fsconfig+0x20/0x40
> [95553.719141] ? x64_sys_call+0x21ee/0x26a0
> [95553.719545] ? do_syscall_64+0xb8/0x670
> [95553.719922] ? x64_sys_call+0x1405/0x26a0
> [95553.720317] ? do_syscall_64+0xb8/0x670
> [95553.720702] ? __x64_sys_close+0x3e/0x90
> [95553.721080] ? x64_sys_call+0x1b5e/0x26a0
> [95553.721478] ? do_syscall_64+0xb8/0x670
> [95553.721841] ? irqentry_exit+0x43/0x50
> [95553.722211] ? exc_page_fault+0x90/0x1b0
> [95553.722681] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [95553.723166] RIP: 0033:0x72ee774f3afe
> [95553.723562] Code: 73 01 c3 48 8b 0d 0a 33 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 49 89 ca b8 af 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d da 32 0f 00 f7 d8 64 89 01 48
> [95553.725188] RSP: 002b:00007ffe97148978 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
> [95553.725892] RAX: ffffffffffffffda RBX: 00005dcfe53d0080 RCX: 000072ee774f3afe
> [95553.726526] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003
> [95553.727176] RBP: 00007ffe97148ac0 R08: 0000000000000000 R09: 000072ee775e7ac0
> [95553.727818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> [95553.728459] R13: 00005dcfe53d04b0 R14: 000072ee77670b00 R15: 00005dcfe53d1a28
> [95553.729086] </TASK>
>
> The panic occurs as follows:
> 1. logical_block_size is 8KiB, causing {struct super_block *sb}->s_blocksize
> is initialized to 0.
> vfat_fill_super
> - fat_fill_super
> - sb_min_blocksize
> - sb_set_blocksize //return 0 when size is 8KiB.
> 2. __bread_gfp is called with size == 0, causing folio_alloc_buffers() to
> compute an offset equal to folio_size(folio), which triggers a BUG_ON.
> fat_fill_super
> - sb_bread
> - __bread_gfp // size == {struct super_block *sb}->s_blocksize == 0
> - bdev_getblk
> - __getblk_slow
> - grow_buffers
> - grow_dev_folio
> - folio_alloc_buffers // size == 0
> - folio_set_bh //offset == folio_size(folio) and panic
>
> To fix this issue, add proper return value checks for
> sb_min_blocksize().
>
> Cc: <stable@vger.kernel.org> # v6.15
> Fixes: a64e5a596067bd ("bdev: add back PAGE_SIZE block size validation for sb_set_blocksize()")
> Reviewed-by: Matthew Wilcox <willy@infradead.org>
> Reviewed-by: Darrick J. Wong <djwong@kernel.org>
> Reviewed-by: Jan Kara <jack@suse.cz>
> Reviewed-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
I'm not sure this goes which route though, to be sure, added cc to akpm.
> ---
> v6:
> - fix 'Fixes tag' format error
> - drop the pointless extern and spell out the parameter of
> sb_set_blocksize and sb_set_blocksize
> v5:
> - add cc tag for 5th patch
> v4:
> - split the changes into 5 patches
> v3:
> - remove the unnecessary blocksize variable definition
> v2:
> - add the __must_check mark to sb_min_blocksize() and include the Fixes
> tag
> ---
> fs/fat/inode.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/fs/fat/inode.c b/fs/fat/inode.c
> index 9648ed097816..9cfe20a3daaf 100644
> --- a/fs/fat/inode.c
> +++ b/fs/fat/inode.c
> @@ -1595,8 +1595,12 @@ int fat_fill_super(struct super_block *sb, struct fs_context *fc,
>
> setup(sb); /* flavour-specific stuff that needs options */
>
> + error = -EINVAL;
> + if (!sb_min_blocksize(sb, 512)) {
> + fat_msg(sb, KERN_ERR, "unable to set blocksize");
> + goto out_fail;
> + }
> error = -EIO;
> - sb_min_blocksize(sb, 512);
> bh = sb_bread(sb, 0);
> if (bh == NULL) {
> fat_msg(sb, KERN_ERR, "unable to read boot sector");
--
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v6 3/5] isofs: check the return value of sb_min_blocksize() in isofs_fill_super
2025-11-04 12:50 ` [PATCH v6 3/5] isofs: check the return value of sb_min_blocksize() in isofs_fill_super Yongpeng Yang
@ 2025-11-04 21:29 ` Damien Le Moal
2025-11-05 2:17 ` Yongpeng Yang
0 siblings, 1 reply; 9+ messages in thread
From: Damien Le Moal @ 2025-11-04 21:29 UTC (permalink / raw)
To: Yongpeng Yang, Namjae Jeon, Sungjong Seo, OGAWA Hirofumi,
Jan Kara, Carlos Maiolino, Jens Axboe, Greg Kroah-Hartman,
Sasha Levin, Alexander Viro, Christian Brauner, Christoph Hellwig
Cc: linux-xfs, linux-fsdevel, linux-block, stable, Matthew Wilcox,
Darrick J . Wong, Yongpeng Yang, Christoph Hellwig
On 11/4/25 21:50, Yongpeng Yang wrote:
> From: Yongpeng Yang <yangyongpeng@xiaomi.com>
>
> sb_min_blocksize() may return 0. Check its return value to avoid
> opt->blocksize and sb->s_blocksize is 0.
>
> Cc: <stable@vger.kernel.org> # v6.15
> Fixes: 1b17a46c9243e9 ("isofs: convert isofs to use the new mount API")
> Reviewed-by: Jan Kara <jack@suse.cz>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
> ---
> fs/isofs/inode.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
> index 6f0e6b19383c..ad3143d4066b 100644
> --- a/fs/isofs/inode.c
> +++ b/fs/isofs/inode.c
> @@ -610,6 +610,11 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc)
> goto out_freesbi;
> }
> opt->blocksize = sb_min_blocksize(s, opt->blocksize);
> + if (!opt->blocksize) {
> + printk(KERN_ERR
> + "ISOFS: unable to set blocksize\n");
Nit: using pr_err() maybe better here ? Not sure what isofs prefers.
> + goto out_freesbi;
> + }
>
> sbi->s_high_sierra = 0; /* default is iso9660 */
> sbi->s_session = opt->session;
--
Damien Le Moal
Western Digital Research
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v6 3/5] isofs: check the return value of sb_min_blocksize() in isofs_fill_super
2025-11-04 21:29 ` Damien Le Moal
@ 2025-11-05 2:17 ` Yongpeng Yang
0 siblings, 0 replies; 9+ messages in thread
From: Yongpeng Yang @ 2025-11-05 2:17 UTC (permalink / raw)
To: Damien Le Moal, Yongpeng Yang, Namjae Jeon, Sungjong Seo,
OGAWA Hirofumi, Jan Kara, Carlos Maiolino, Jens Axboe,
Greg Kroah-Hartman, Sasha Levin, Alexander Viro,
Christian Brauner, Christoph Hellwig
Cc: linux-xfs, linux-fsdevel, linux-block, stable, Matthew Wilcox,
Darrick J . Wong, Yongpeng Yang, Christoph Hellwig
On 11/5/25 05:29, Damien Le Moal wrote:
> On 11/4/25 21:50, Yongpeng Yang wrote:
>> From: Yongpeng Yang <yangyongpeng@xiaomi.com>
>>
>> sb_min_blocksize() may return 0. Check its return value to avoid
>> opt->blocksize and sb->s_blocksize is 0.
>>
>> Cc: <stable@vger.kernel.org> # v6.15
>> Fixes: 1b17a46c9243e9 ("isofs: convert isofs to use the new mount API")
>> Reviewed-by: Jan Kara <jack@suse.cz>
>> Reviewed-by: Christoph Hellwig <hch@lst.de>
>> Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
>> ---
>> fs/isofs/inode.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
>> index 6f0e6b19383c..ad3143d4066b 100644
>> --- a/fs/isofs/inode.c
>> +++ b/fs/isofs/inode.c
>> @@ -610,6 +610,11 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc)
>> goto out_freesbi;
>> }
>> opt->blocksize = sb_min_blocksize(s, opt->blocksize);
>> + if (!opt->blocksize) {
>> + printk(KERN_ERR
>> + "ISOFS: unable to set blocksize\n");
>
> Nit: using pr_err() maybe better here ? Not sure what isofs prefers.
>
Thanks for the review. I checked fs/isofs/inode.c, and other functions
seem to prefer using "printk(KERN_ERR|KERN_DEBUG|KERN_WARNING ...)"
rather than "pr_err|pr_debug|pr_warn".
Yongpeng,
>> + goto out_freesbi;
>> + }
>>
>> sbi->s_high_sierra = 0; /* default is iso9660 */
>> sbi->s_session = opt->session;
>
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks
2025-11-04 12:50 [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks Yongpeng Yang
` (4 preceding siblings ...)
2025-11-04 17:00 ` [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks OGAWA Hirofumi
@ 2025-11-05 11:17 ` Christian Brauner
5 siblings, 0 replies; 9+ messages in thread
From: Christian Brauner @ 2025-11-05 11:17 UTC (permalink / raw)
To: Yongpeng Yang
Cc: Christian Brauner, linux-xfs, linux-fsdevel, linux-block, stable,
Matthew Wilcox, Darrick J . Wong, Yongpeng Yang,
Christoph Hellwig, Namjae Jeon, Sungjong Seo, OGAWA Hirofumi,
Jan Kara, Carlos Maiolino, Jens Axboe, Greg Kroah-Hartman,
Sasha Levin, Alexander Viro, Christoph Hellwig
On Tue, 04 Nov 2025 20:50:06 +0800, Yongpeng Yang wrote:
> When emulating an nvme device on qemu with both logical_block_size and
> physical_block_size set to 8 KiB, but without format, a kernel panic
> was triggered during the early boot stage while attempting to mount a
> vfat filesystem.
>
> [95553.682035] EXT4-fs (nvme0n1): unable to set blocksize
> [95553.684326] EXT4-fs (nvme0n1): unable to set blocksize
> [95553.686501] EXT4-fs (nvme0n1): unable to set blocksize
> [95553.696448] ISOFS: unsupported/invalid hardware sector size 8192
> [95553.697117] ------------[ cut here ]------------
> [95553.697567] kernel BUG at fs/buffer.c:1582!
> [95553.697984] Oops: invalid opcode: 0000 [#1] SMP NOPTI
> [95553.698602] CPU: 0 UID: 0 PID: 7212 Comm: mount Kdump: loaded Not tainted 6.18.0-rc2+ #38 PREEMPT(voluntary)
> [95553.699511] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
> [95553.700534] RIP: 0010:folio_alloc_buffers+0x1bb/0x1c0
> [95553.701018] Code: 48 8b 15 e8 93 18 02 65 48 89 35 e0 93 18 02 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 90 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f
> [95553.702648] RSP: 0018:ffffd1b0c676f990 EFLAGS: 00010246
> [95553.703132] RAX: ffff8cfc4176d820 RBX: 0000000000508c48 RCX: 0000000000000001
> [95553.703805] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 0000000000000000
> [95553.704481] RBP: ffffd1b0c676f9c8 R08: 0000000000000000 R09: 0000000000000000
> [95553.705148] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
> [95553.705816] R13: 0000000000002000 R14: fffff8bc8257e800 R15: 0000000000000000
> [95553.706483] FS: 000072ee77315840(0000) GS:ffff8cfdd2c8d000(0000) knlGS:0000000000000000
> [95553.707248] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [95553.707782] CR2: 00007d8f2a9e5a20 CR3: 0000000039d0c006 CR4: 0000000000772ef0
> [95553.708439] PKRU: 55555554
> [95553.708734] Call Trace:
> [95553.709015] <TASK>
> [95553.709266] __getblk_slow+0xd2/0x230
> [95553.709641] ? find_get_block_common+0x8b/0x530
> [95553.710084] bdev_getblk+0x77/0xa0
> [95553.710449] __bread_gfp+0x22/0x140
> [95553.710810] fat_fill_super+0x23a/0xfc0
> [95553.711216] ? __pfx_setup+0x10/0x10
> [95553.711580] ? __pfx_vfat_fill_super+0x10/0x10
> [95553.712014] vfat_fill_super+0x15/0x30
> [95553.712401] get_tree_bdev_flags+0x141/0x1e0
> [95553.712817] get_tree_bdev+0x10/0x20
> [95553.713177] vfat_get_tree+0x15/0x20
> [95553.713550] vfs_get_tree+0x2a/0x100
> [95553.713910] vfs_cmd_create+0x62/0xf0
> [95553.714273] __do_sys_fsconfig+0x4e7/0x660
> [95553.714669] __x64_sys_fsconfig+0x20/0x40
> [95553.715062] x64_sys_call+0x21ee/0x26a0
> [95553.715453] do_syscall_64+0x80/0x670
> [95553.715816] ? __fs_parse+0x65/0x1e0
> [95553.716172] ? fat_parse_param+0x103/0x4b0
> [95553.716587] ? vfs_parse_fs_param_source+0x21/0xa0
> [95553.717034] ? __do_sys_fsconfig+0x3d9/0x660
> [95553.717548] ? __x64_sys_fsconfig+0x20/0x40
> [95553.717957] ? x64_sys_call+0x21ee/0x26a0
> [95553.718360] ? do_syscall_64+0xb8/0x670
> [95553.718734] ? __x64_sys_fsconfig+0x20/0x40
> [95553.719141] ? x64_sys_call+0x21ee/0x26a0
> [95553.719545] ? do_syscall_64+0xb8/0x670
> [95553.719922] ? x64_sys_call+0x1405/0x26a0
> [95553.720317] ? do_syscall_64+0xb8/0x670
> [95553.720702] ? __x64_sys_close+0x3e/0x90
> [95553.721080] ? x64_sys_call+0x1b5e/0x26a0
> [95553.721478] ? do_syscall_64+0xb8/0x670
> [95553.721841] ? irqentry_exit+0x43/0x50
> [95553.722211] ? exc_page_fault+0x90/0x1b0
> [95553.722681] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [95553.723166] RIP: 0033:0x72ee774f3afe
> [95553.723562] Code: 73 01 c3 48 8b 0d 0a 33 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 49 89 ca b8 af 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d da 32 0f 00 f7 d8 64 89 01 48
> [95553.725188] RSP: 002b:00007ffe97148978 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
> [95553.725892] RAX: ffffffffffffffda RBX: 00005dcfe53d0080 RCX: 000072ee774f3afe
> [95553.726526] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003
> [95553.727176] RBP: 00007ffe97148ac0 R08: 0000000000000000 R09: 000072ee775e7ac0
> [95553.727818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> [95553.728459] R13: 00005dcfe53d04b0 R14: 000072ee77670b00 R15: 00005dcfe53d1a28
> [95553.729086] </TASK>
>
> [...]
Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.
Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.
It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.
Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes
[1/5] vfat: fix missing sb_min_blocksize() return value checks
https://git.kernel.org/vfs/vfs/c/c9374affbcb5
[2/5] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
https://git.kernel.org/vfs/vfs/c/d1178095d240
[3/5] isofs: check the return value of sb_min_blocksize() in isofs_fill_super
https://git.kernel.org/vfs/vfs/c/f0e6852b29d1
[4/5] xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super
https://git.kernel.org/vfs/vfs/c/018e0be111cb
[5/5] block: add __must_check attribute to sb_min_blocksize()
https://git.kernel.org/vfs/vfs/c/11fee7948917
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2025-11-05 11:18 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-04 12:50 [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 2/5] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 3/5] isofs: check the return value of sb_min_blocksize() in isofs_fill_super Yongpeng Yang
2025-11-04 21:29 ` Damien Le Moal
2025-11-05 2:17 ` Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 4/5] xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super Yongpeng Yang
2025-11-04 12:50 ` [PATCH v6 5/5] block: add __must_check attribute to sb_min_blocksize() Yongpeng Yang
2025-11-04 17:00 ` [PATCH v6 1/5] vfat: fix missing sb_min_blocksize() return value checks OGAWA Hirofumi
2025-11-05 11:17 ` Christian Brauner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).