While working on the HugeTLB Vmemmap Optimization (HVO) generalization, Sashiko reported that memmap_init_zone_device() could be asked to initialize struct pages with a large-page order for a physical range that was not naturally aligned to that order.
Following the Device DAX call path confirmed that the condition was reachable. Device DAX range validation checks the range size, but not its start address. An unaligned range can therefore reach memmap_init_zone_device() after the device binds, and a subsequent write to a userspace mapping may trigger a kernel panic. With the help of an LLM, I was able to reproduce the failure. The automatic resize path has a related problem. It can split an aligned size request across arbitrary free gaps, consume an unaligned fragment, and leave the resize partially applied when a later allocation fails. This series first fixes the mapping sysfs attribute to propagate validation failures. It then validates both the start and size of every Device DAX range and makes automatic resize account only for usable aligned space. The changes were tested by booting the kernel in a VM with a fragmented dynamic DAX region. Misaligned mappings were rejected with -EINVAL, aligned allocation and multi-range mmap read/write succeeded, and an allocation exceeding the usable aligned space returned -ENOSPC without leaving a partial allocation. v2: - Return explicit errors before Device DAX range allocation (suggested by Dave Jiang) - Move the mapping error reporting fix before the range alignment validation fix for independent backports (suggested by Dave Jiang) - Keep the alloc_is_aligned() name to avoid unrelated helper renaming (suggested by Dave Jiang) v1: https://lore.kernel.org/all/[email protected]/ Muchun Song (2): dax/bus: fix mapping attribute error reporting dax/bus: fix Device DAX range alignment validation drivers/dax/bus.c | 142 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 110 insertions(+), 32 deletions(-) base-commit: 93f51579e7df248780214094418f205253383cc5 -- 2.54.0
