Commit 957ac8c4 authored by Jeff Moyer's avatar Jeff Moyer Committed by Dan Williams

dax: fix PMD faults on zero-length files

PMD faults on a zero length file on a file system mounted with -o dax
will not generate SIGBUS as expected.

	fd = open(...O_TRUNC);
	addr = mmap(NULL, 2*1024*1024, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
	*addr = 'a';
        <expect SIGBUS>

The problem is this code in dax_iomap_pmd_fault:

	max_pgoff = (i_size_read(inode) - 1) >> PAGE_SHIFT;

If the inode size is zero, we end up with a max_pgoff that is way larger
than 0.  :)  Fix it by using DIV_ROUND_UP, as is done elsewhere in the

I tested this with some simple test code that ensured that SIGBUS was
received where expected.

Cc: <>
Fixes: 642261ac ("dax: add struct iomap based DAX PMD support")
Signed-off-by: default avatarJeff Moyer <>
Signed-off-by: default avatarDan Williams <>
parent 6a21586a
......@@ -1333,7 +1333,7 @@ static int dax_iomap_pmd_fault(struct vm_fault *vmf, pfn_t *pfnp,
* this is a reliable test.
pgoff = linear_page_index(vma, pmd_addr);
max_pgoff = (i_size_read(inode) - 1) >> PAGE_SHIFT;
max_pgoff = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
trace_dax_pmd_fault(inode, vmf, max_pgoff, 0);
......@@ -1357,13 +1357,13 @@ static int dax_iomap_pmd_fault(struct vm_fault *vmf, pfn_t *pfnp,
if ((pmd_addr + PMD_SIZE) > vma->vm_end)
goto fallback;
if (pgoff > max_pgoff) {
if (pgoff >= max_pgoff) {
goto out;
/* If the PMD would extend beyond the file size */
if ((pgoff | PG_PMD_COLOUR) > max_pgoff)
if ((pgoff | PG_PMD_COLOUR) >= max_pgoff)
goto fallback;
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment