Re: [PATCH] dax/pmem: fix unaligned compound devmap initialization

[Muchun Song]

> On Nov 6, 2026, at 06:58, Alison Schofield <alison.schofield@xxxxxxxxx> wrote:
> 
> On Fri, Oct 16, 2026 at 01:49:14PM +0800, Muchun Song wrote:
>> Static pmem Device DAX namespaces reserve space for namespace metadata
>> before the user-visible data range, and may also include padding needed
>> to satisfy the Device DAX alignment. __dax_pmem_probe() adjusts the
>> dax_region range to start at the data range, but the dev_pagemap range
>> still starts at the beginning of the namespace.
>> 
>> That is not valid for compound devmap mappings whose memmap is stored in
>> system RAM. Compound page initialization requires the start PFN to be
>> naturally aligned to the compound page size, because the head and tail
>> struct pages are initialized according to that geometry. If the pgmap
>> starts before the aligned data range, memmap_init_zone_device() can build
>> compound page metadata from an unaligned PFN.
>> 
>> The resulting struct page layout is inconsistent with the Device DAX
>> mapping. A later mmap fault can then resolve the user-visible PFN through
>> invalid compound page metadata and hit a kernel panic while inserting the
>> DAX folio.
>> 
>> Fix this by advancing the pgmap start to the aligned Device DAX data
>> range for non-altmap compound mappings. Leave base-page namespaces
>> unchanged, and leave the altmap path unchanged because
>> memmap_init_zone_device() already skips the altmap reservation itself.
>> 
>> Fixes: 14606001efb4 ("device-dax: compound devmap support")
>> Cc: <stable@xxxxxxxxxxxxxxx>
>> Reported-by: Ritesh Harjani (IBM) <ritesh.list@xxxxxxxxx>
>> Closes: https://lore.kernel.org/r/wlrkqqvg.ritesh.list@xxxxxxxxx
>> Assisted-by: LLM
>> Signed-off-by: Muchun Song <songmuchun@xxxxxxxxxxxxx>
>> ---
>> drivers/dax/pmem.c | 7 +++++++
>> 1 file changed, 7 insertions(+)
>> 
>> diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
>> index bee93066a849..d3a9b85107b0 100644
>> --- a/drivers/dax/pmem.c
>> +++ b/drivers/dax/pmem.c
>> @@ -51,6 +51,13 @@ static struct dev_dax *__dax_pmem_probe(struct device *dev)
>> 	/* adjust the dax_region range to the start of data */
>> 	range = pgmap.range;
>> 	range.start += offset;
>> +	/*
>> +	 * When the memmap is stored in RAM, exclude metadata and alignment
>> +	 * padding from compound page initialization.  Otherwise, the pgmap
>> +	 * may start before the naturally aligned Device DAX data range.
>> +	 */
>> +	if (!pgmap_altmap(&pgmap) && le32_to_cpu(pfn_sb->align) > PAGE_SIZE)
>> +	pgmap.range.start = range.start;
> 
> 
> Hi Muchun,

Hi,

> 
> Does moving the start here lose vmemmap savings when the old start
> was already aligned? ie. on x86_64 with -M mem and 2M alignment, a
> namespace starting on a 128M section boundary has its data at +2M. The
> first section then becomes a partial add, which 2ef77f4a7d5a
> ("mm/sparse-vmemmap: set compound page order for device DAX") doesn't
> optimize. Would that cost about 1.7 MiB of extra vmemmap?
> 
> Can you round the original pgmap start up to the alignment to avoid
> that loss, and still fix the crash?

Yes, you are right. Rounding up the original pgmap start still fixes
the crash without losing the vmemmap savings. I'll use the following
change for v2.

diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
index d3a9b85107b0..d54d23f1cc58 100644
--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -52,12 +52,11 @@ static struct dev_dax *__dax_pmem_probe(struct device *dev)
        range = pgmap.range;
        range.start += offset;
        /*
-        * When the memmap is stored in RAM, exclude metadata and alignment
-        * padding from compound page initialization.  Otherwise, the pgmap
-        * may start before the naturally aligned Device DAX data range.
+        * When the memmap is stored in RAM, compound page initialization
+        * must start at a naturally aligned address.
         */
-       if (!pgmap_altmap(&pgmap) && le32_to_cpu(pfn_sb->align) > PAGE_SIZE)
-               pgmap.range.start = range.start;
+       if (!pgmap_altmap(&pgmap))
+               pgmap.range.start = ALIGN(pgmap.range.start, nd_pfn->align);
        dax_region = alloc_dax_region(dev, region_id, &range,
                        nd_region->target_node, le32_to_cpu(pfn_sb->align),
                        IORESOURCE_DAX_STATIC);

Thanks,
Muchun

> 
> -- Alison
> 
> 
> 
>> 	dax_region = alloc_dax_region(dev, region_id, &range,
>> 			nd_region->target_node, le32_to_cpu(pfn_sb->align),
>> 			IORESOURCE_DAX_STATIC);
>> 
>> base-commit: 0fcb05b72344f40806cbe810de8872f1698bf053
>> -- 
>> 2.54.0