> On Sep 22, 2026, at 03:23, Dave Jiang <[email protected]> wrote:
>
>
>
> On 9/15/26 2:56 AM, Muchun Song wrote:
>> After the DAX configuration locking was converted to rwsems, successful
>> lock acquisition leaves rc set to zero in mapping_store(). If the requested
>> range size is misaligned, the allocation is skipped and the zero rc is
>> converted to len. The sysfs write therefore reports success without
>> allocating the requested range.
>>
>> Call alloc_dev_dax_range() unconditionally and let its full range
>> validation return -EINVAL for a misaligned start or size.
>>
>> Fixes: c05ae9d85b47 ("dax/bus.c: replace driver-core lock usage by a local
>> rwsem")
>> Assisted-by: LLM
>> Signed-off-by: Muchun Song <[email protected]>
>> ---
>> drivers/dax/bus.c | 3 +--
>> 1 file changed, 1 insertion(+), 2 deletions(-)
>>
>> diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
>> index 54e4bbc98218..f232001ff5b7 100644
>> --- a/drivers/dax/bus.c
>> +++ b/drivers/dax/bus.c
>> @@ -1276,8 +1276,7 @@ static ssize_t mapping_store(struct device *dev,
>> struct device_attribute *attr,
>> }
>>
>> to_alloc = range_len(&r);
>> - if (size_is_aligned(dev_dax, to_alloc))
>> - rc = alloc_dev_dax_range(dev_dax, r.start, to_alloc);
>> + rc = alloc_dev_dax_range(dev_dax, r.start, to_alloc);
>> up_write(&dax_dev_rwsem);
>> up_write(&dax_region_rwsem);
>>
>
> So this patch becomes somewhat of a backport issue as it depends on patch 1.
> Please consider swap the ordering of your patch series and fix this issue
> first. Maybe something like so the fix can be independently backported:
Make sense. I'll update soon.
Thanks,
Muchun
>
> diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
> index b809e1a264af..e40c25401cf0 100644
> --- a/drivers/dax/bus.c
> +++ b/drivers/dax/bus.c
> @@ -1192,7 +1192,7 @@ static ssize_t mapping_store(struct device *dev, struct
> de
> vice_attribute *attr,
> return rc;
> if (!dax_region->dev->driver) {
> up_write(&dax_region_rwsem);
> - return rc;
> + return -ENXIO;
> }
> rc = down_write_killable(&dax_dev_rwsem);
> if (rc) {
> @@ -1201,8 +1201,12 @@ static ssize_t mapping_store(struct device *dev,
> struct d
> evice_attribute *attr,
> }
>
> to_alloc = range_len(&r);
> - if (alloc_is_aligned(dev_dax, to_alloc))
> + if (!alloc_is_aligned(dev_dax, to_alloc)) {
> + dev_dbg(dev, "%s: size: %zu misaligned\n", __func__,
> to_alloc);
> + rc = -EINVAL;
> + } else {
> rc = alloc_dev_dax_range(dev_dax, r.start, to_alloc);
> + }
> up_write(&dax_dev_rwsem);
> up_write(&dax_region_rwsem);
