From ec7ea9a1f03f36672cf5acb23761cfef6b948f21 Mon Sep 17 00:00:00 2001 From: Shaurya Rane Date: Sun, 30 Nov 2025 20:27:25 +0530 Subject: [PATCH] mm/readahead: fix race between page_cache_ra_order and set_blocksize page_cache_ra_order() reads mapping_min_folio_order() before acquiring the invalidate_lock, creating a time-of-check-time-of-use (TOCTOU) race with set_blocksize() which can change the mapping's min_folio_order while holding the invalidate_lock exclusively. If set_blocksize() increases the mapping's min_folio_order after page_cache_ra_order() reads the old value but before it adds folios to the page cache, the VM_BUG_ON check in __filemap_add_folio() will trigger: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping), folio); This can happen because the stale min_order is used to calculate new_order and constrain the folio order, but filemap_add_folio() re-reads the (now increased) min_folio_order from the mapping. Fix this by moving the read of mapping_min_folio_order() and the new_order calculation to after the invalidate_lock is acquired in shared mode. Reported-by: syzbot+4d3cc33ef7a77041efa6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug\?extid\=4d3cc33ef7a77041efa6 Fixes: 47dd67532303 ("block/bdev: lift block size restrictions to 64k") Cc: stable@vger.kernel.org Signed-off-by: Shaurya Rane --- mm/readahead.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/mm/readahead.c b/mm/readahead.c index 3a4b5d58eeb6..95718f87bd43 100644 --- a/mm/readahead.c +++ b/mm/readahead.c @@ -467,7 +467,7 @@ void page_cache_ra_order(struct readahead_control *ractl, struct address_space *mapping = ractl->mapping; pgoff_t start = readahead_index(ractl); pgoff_t index = start; - unsigned int min_order = mapping_min_folio_order(mapping); + unsigned int min_order; pgoff_t limit = (i_size_read(mapping->host) - 1) >> PAGE_SHIFT; pgoff_t mark = index + ra->size - ra->async_size; unsigned int nofs; @@ -483,15 +483,22 @@ void page_cache_ra_order(struct readahead_control *ractl, limit = min(limit, index + ra->size - 1); + /* See comment in page_cache_ra_unbounded() */ + nofs = memalloc_nofs_save(); + filemap_invalidate_lock_shared(mapping); + + /* + * Re-read min_order after acquiring the invalidate_lock to avoid a + * race with set_blocksize() which can change the mapping's min_order + * while holding the invalidate_lock exclusively. + */ + min_order = mapping_min_folio_order(mapping); new_order = min(mapping_max_folio_order(mapping), new_order); new_order = min_t(unsigned int, new_order, ilog2(ra->size)); new_order = max(new_order, min_order); ra->order = new_order; - /* See comment in page_cache_ra_unbounded() */ - nofs = memalloc_nofs_save(); - filemap_invalidate_lock_shared(mapping); /* * If the new_order is greater than min_order and index is * already aligned to new_order, then this will be noop as index -- 2.34.1