linux-kernel - Re: [PATCH] block: reject bs > ps block devices when THP is disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aGiA5yayJwnGdp6i@bombadil.infradead.org>
Date: Fri, 4 Jul 2025 18:33:27 -0700
From: Luis Chamberlain <mcgrof@...nel.org>
To: Pankaj Raghav <p.raghav@...sung.com>
Cc: Matthew Wilcox <willy@...radead.org>, Hannes Reinecke <hare@...e.de>,
	Jens Axboe <axboe@...nel.dk>, linux-kernel@...r.kernel.org,
	linux-block@...r.kernel.org, gost.dev@...sung.com,
	kernel@...kajraghav.com, hch@....de,
	Christian Brauner <brauner@...nel.org>
Subject: Re: [PATCH] block: reject bs > ps block devices when THP is disabled

On Fri, Jul 04, 2025 at 11:21:34AM +0200, Pankaj Raghav wrote:
> If THP is disabled and when a block device with logical block size >
> page size is present, the following null ptr deref panic happens during
> boot:
> 
> [   [13.2 mK  AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07]
> [   13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380
> <snip>
> [   13.025448] Call Trace:
> [   13.025692]  <TASK>
> [   13.025895]  block_read_full_folio+0x610/0x780
> [   13.026379]  ? __pfx_blkdev_get_block+0x10/0x10
> [   13.027008]  ? __folio_batch_add_and_move+0x1fa/0x2b0
> [   13.027548]  ? __pfx_blkdev_read_folio+0x10/0x10
> [   13.028080]  filemap_read_folio+0x9b/0x200
> [   13.028526]  ? __pfx_filemap_read_folio+0x10/0x10
> [   13.029030]  ? __filemap_get_folio+0x43/0x620
> [   13.029497]  do_read_cache_folio+0x155/0x3b0
> [   13.029962]  ? __pfx_blkdev_read_folio+0x10/0x10
> [   13.030381]  read_part_sector+0xb7/0x2a0
> [   13.030805]  read_lba+0x174/0x2c0
> <snip>
> [   13.045348]  nvme_scan_ns+0x684/0x850 [nvme_core]
> [   13.045858]  ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core]
> [   13.046414]  ? _raw_spin_unlock+0x15/0x40
> [   13.046843]  ? __switch_to+0x523/0x10a0
> [   13.047253]  ? kvm_clock_get_cycles+0x14/0x30
> [   13.047742]  ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core]
> [   13.048353]  async_run_entry_fn+0x96/0x4f0
> [   13.048787]  process_one_work+0x667/0x10a0
> [   13.049219]  worker_thread+0x63c/0xf60
> 
> As large folio support depends on THP, only allow bs > ps block devices
> if THP is enabled.
> 
> Fixes: 47dd67532303 ("block/bdev: lift block size restrictions to 64k")
> Signed-off-by: Pankaj Raghav <p.raghav@...sung.com>

Reviewed-by: Luis Chamberlain <mcgrof@...nel.org>

I guess 0-day and syzbot doesn't test non-THP kernels, or they just
hand't tried a block device with a larger sector size yet. I know LTP
had their code updated to use the new limit so that'll take a while to
propagate.

  Luis