linux-kernel - Re: [PATCH] mm/memremap: fix spurious large folio warning for FS-DAX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <74npmrpzagba2bbye7kmwwoguafbpvnkxarprp3txy4wmu6gxp@japia7ysaisi>
Date: Thu, 18 Dec 2025 09:58:02 +1100
From: Alistair Popple <apopple@...dia.com>
To: John Groves <John@...ves.net>
Cc: David Hildenbrand <david@...nel.org>, 
	Oscar Salvador <osalvador@...e.de>, Andrew Morton <akpm@...ux-foundation.org>, 
	John Groves <jgroves@...ron.com>, "Darrick J . Wong" <djwong@...nel.org>, 
	Dan Williams <dan.j.williams@...el.com>, Gregory Price <gourry@...rry.net>, 
	Balbir Singh <bsingharora@...il.com>, linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	linux-cxl@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
	Aravind Ramesh <arramesh@...ron.com>, Ajay Joshi <ajayjoshi@...ron.com>
Subject: Re: [PATCH] mm/memremap: fix spurious large folio warning for FS-DAX

On 2025-12-18 at 08:13 +1100, John Groves <John@...ves.net> wrote...
> From: John Groves <John@...ves.net>
> 
> This patch addresses a warning that I discovered while working on famfs,
> which is an fs-dax file system that virtually always does PMD faults
> (next famfs patch series coming after the holidays).
> 
> However, XFS also does PMD faults in fs-dax mode, and it also triggers
> the warning. It takes some effort to get XFS to do a PMD fault, but
> instructions to reproduce it are below.
> 
> The VM_WARN_ON_ONCE(folio_test_large(folio)) check in
> free_zone_device_folio() incorrectly triggers for MEMORY_DEVICE_FS_DAX
> when PMD (2MB) mappings are used.
> 
> FS-DAX legitimately creates large file-backed folios when handling PMD
> faults. This is a core feature of FS-DAX that provides significant
> performance benefits by mapping 2MB regions directly to persistent
> memory. When these mappings are unmapped, the large folios are freed
> through free_zone_device_folio(), which triggers the spurious warning.

Yep, and I'm pretty sure devdax can also create large folios so we might need
a similar fix there. In fact looking at old vs. new code it seems we only ever
used to have this warning for anon folios, which I think could only ever be true
for DEVICE_PRIVATE or DEVICE_COHERENT folios.

So I suspect the proper fix is to just remove the warning entirely now that they
also support compound sizes.

> The warning was introduced by commit that added support for large zone
> device private folios. However, that commit did not account for FS-DAX
> file-backed folios, which have always supported large (PMD-sized)
> mappings.

Right, one of the nice side-effects (other than delaying fam-fs, sorry! :-/) of
fixing the refcounting was that these started looking like normal large folios.

> The check distinguishes between anonymous folios (which clear
> AnonExclusive flags for each sub-page) and file-backed folios. For
> file-backed folios, it assumes large folios are unexpected - but this
> assumption is incorrect for FS-DAX.
> 
> The fix is to exempt MEMORY_DEVICE_FS_DAX from the large folio warning,
> allowing FS-DAX to continue using PMD mappings without triggering false
> warnings.

As this is a fix you will want a "Fixes:" tag.

> Signed-off-by: John Groves <john@...ves.net>
> ---
> === How to reproduce ===
> 
> A reproducer is available at:
> 
>     git clone https://github.com/jagalactic/dax-pmd-test.git
>     cd xfs-dax-test
>     make
>     sudo make test
> 
> This will set up XFS on pmem with 2MB stripe alignment and run a test
> that triggers the warning.
> 
> Alternatively, follow the manual steps below.
> 
> Prerequisites:
>   - Linux kernel with FS-DAX support and CONFIG_DEBUG_VM=y
>   - A pmem device (real or emulated)
>   - An fsdax namespace configured via ndctl as /dev/pmem0
> 
> Manual steps:
> 
> 1. Create an fsdax namespace (if not already present):
>    # ndctl create-namespace -m fsdax -e namespace0.0
> 
> 2. Create XFS with 2MB stripe alignment:
>    # mkfs.xfs -f -d su=2m,sw=1 /dev/pmem0
>    # mount -o dax /dev/pmem0 /mnt/pmem
> 
> 3. Compile and run the reproducer:
>    # gcc -Wall -O2 -o dax_pmd_test dax_pmd_test.c
>    # ./dax_pmd_test /mnt/pmem/testfile
> 
> 4. Check dmesg for the warning:
>    WARNING: mm/memremap.c:431 at free_zone_device_folio+0x.../0x...
> 
> Note: The 2MB stripe alignment (-d su=2m,sw=1) is critical. XFS normally
> allocates blocks at arbitrary offsets, causing PMD faults to fall back
> to PTE faults. The stripe alignment forces 2MB-aligned allocations,
> allowing PMD faults to succeed and exposing this bug.

Thanks for the detailed repro instructions. Not always neccessary but definitely
nice to have.

> === Proposed fix ===
> 
> mm/memremap.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/memremap.c b/mm/memremap.c
> index 4c2e0d68eb27..af37c3b4e39b 100644
> --- a/mm/memremap.c
> +++ b/mm/memremap.c
> @@ -428,7 +428,12 @@ void free_zone_device_folio(struct folio *folio)
>  		for (i = 0; i < nr; i++)
>  			__ClearPageAnonExclusive(folio_page(folio, i));
>  	} else {
> -		VM_WARN_ON_ONCE(folio_test_large(folio));
> +		/*
> +		 * FS_DAX legitimately uses large file-mapped folios for
> +		 * PMD mappings, so only warn for other device types.
> +		 */
> +		VM_WARN_ON_ONCE(pgmap->type != MEMORY_DEVICE_FS_DAX &&
> +				folio_test_large(folio));
>  	}
>  
>  	/*
> 
> base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
> -- 
> 2.49.0
>