Re: [PATCH 10/14] xfarray: don't crash when sorting if array element crosses a folio

[Christoph Hellwig <hch@infradead.org>]

On Sun, Sep 20, 2026 at 11:17:35PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <djwong@kernel.org>
> 
> LOLLM points out that if an array element crosses a folio boundary,
> xfile_get_folio returns a NULL folio pointer.  If this happens,
> si->folio is also set to NULL, and calling folio_pos/folio_address will
> just crash the kernel.  Teach this function to handle this condition by
> falling back to reading the array element into scratchpad memory.
> 
> Cc: <stable@vger.kernel.org> # v6.6
> Fixes: cf36f4f64c2d4e ("xfs: cache pages used for xfarray quicksort convergence")
> Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
> Assisted-by: LOLLM # finding obvious bugs
> ---
>  fs/xfs/scrub/xfarray.c |   18 ++++++++++--------
>  1 file changed, 10 insertions(+), 8 deletions(-)
> 
> 
> diff --git a/fs/xfs/scrub/xfarray.c b/fs/xfs/scrub/xfarray.c
> index 2ce24bfe4c0fab..30a58e9d4378e4 100644
> --- a/fs/xfs/scrub/xfarray.c
> +++ b/fs/xfs/scrub/xfarray.c
> @@ -830,22 +830,24 @@ xfarray_sort_scan(
>  			return PTR_ERR(folio);
>  		si->folio = folio;
>  
> -		si->first_folio_idx = xfarray_idx(si->array,
> -				folio_pos(si->folio) + si->array->obj_size - 1);
> +		if (si->folio) {
> +			si->first_folio_idx = xfarray_idx(si->array,
> +					folio_pos(si->folio) + si->array->obj_size - 1);

Overly long line.

> +			if (xfarray_pos(si->array, si->last_folio_idx + 1) > next_pos)

Another one.

> +	if (!si->folio || idx < si->first_folio_idx || idx > si->last_folio_idx) {

And one more.