From patchwork Tue Aug 13 18:25:56 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Boris Burkov X-Patchwork-Id: 13762392 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B285EC52D7B for ; Tue, 13 Aug 2024 18:26:03 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 37E9B6B0095; Tue, 13 Aug 2024 14:26:03 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 32D826B0098; Tue, 13 Aug 2024 14:26:03 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1F56D6B009F; Tue, 13 Aug 2024 14:26:03 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 002E86B0095 for ; Tue, 13 Aug 2024 14:26:02 -0400 (EDT) Received: from smtpin01.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id A0D78160A40 for ; Tue, 13 Aug 2024 18:26:02 +0000 (UTC) X-FDA: 82448051364.01.E8AC13F Received: from fout8-smtp.messagingengine.com (fout8-smtp.messagingengine.com [103.168.172.151]) by imf16.hostedemail.com (Postfix) with ESMTP id 9CF2E180023 for ; Tue, 13 Aug 2024 18:25:59 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=bur.io header.s=fm1 header.b=NB4b+kfC; dkim=pass header.d=messagingengine.com header.s=fm3 header.b=UgH5jowp; dmarc=none; spf=pass (imf16.hostedemail.com: domain of boris@bur.io designates 103.168.172.151 as permitted sender) smtp.mailfrom=boris@bur.io ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1723573480; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=mnBJcrBpn6Um9lZMP0DmOVGHsQghXPdlGKNolmy4ucE=; b=EGKwqqQ4UqjsKjKZYkqmBs3ZfygCKJUPCPTXLuVC5ukljlpH+ny0kIzzm2mLccQeitS9Ho 49J8m3qoUKlkiMcWiZVNs6asiQvn/b2NEOcnXam4jdGaHNiOYLCWEWPn6p5y8AsEz2rbNh 5MOnW8oYKt1o0xBT/p4hTI/H/BnYWl8= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1723573480; a=rsa-sha256; cv=none; b=5yFMb42GSdpjNfV9RfkARTjfdeg///r8HYmj41G0BE5ax8dlmEwEeQ18vDOtSp1Ci/vaHf siSS3N8XqFoZOej/iXwtPL2MkUgtXCRA30QHcM5lnvv+fJXJCeFbdbVbq84/T1qhuuceTQ 2qL8dkKNfvUENIIP4Skd7ihagKXZ4rY= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=bur.io header.s=fm1 header.b=NB4b+kfC; dkim=pass header.d=messagingengine.com header.s=fm3 header.b=UgH5jowp; dmarc=none; spf=pass (imf16.hostedemail.com: domain of boris@bur.io designates 103.168.172.151 as permitted sender) smtp.mailfrom=boris@bur.io Received: from phl-compute-05.internal (phl-compute-05.nyi.internal [10.202.2.45]) by mailfout.nyi.internal (Postfix) with ESMTP id D6AF8138FD3C; Tue, 13 Aug 2024 14:25:58 -0400 (EDT) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-05.internal (MEProxy); Tue, 13 Aug 2024 14:25:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bur.io; h=cc:cc :content-transfer-encoding:content-type:date:date:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to; s=fm1; t=1723573558; x=1723659958; bh=mnBJcrBpn6Um9lZMP0DmO VGHsQghXPdlGKNolmy4ucE=; b=NB4b+kfCv4c8XJRg7JZYYeISB5mjpNX0HmIEh zLmPbI/miaRdmI/BB4Gs2Ip156iZcUwc2isTM9ual42JSLQkLHB1CgTMDvsga27l CIGD9NQ+pgDP/dUt0R1yMFrEgdOEWo3WJfq3ZNAbTEOSJ3sDag7RgX5O9mox6djx KGK8mH0ocwezuKZKAOLFI0BxXCOI7s9+fHq5/MxIMyjNqCuHE6dpOn37NFx9Usb8 PmCsmYaMr7860yBD976I5c1Rrgj+jAaL8a5ad+6EMZ6dSfw1sl8r4bwi/nbseSPv lRfQr1YiFwIyC791fnPr8ZOcF5PH2hRYc+zqeS1qIY/FCNB2Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:message-id:mime-version:reply-to:subject:subject:to :to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; t=1723573558; x=1723659958; bh=mnBJcrBpn6Um9lZMP0DmOVGHsQgh XPdlGKNolmy4ucE=; b=UgH5jowpOU+ZmUnm2mFlR0DLzkOSXSc2i4SrjFl1L3y8 Pzboqo3NbktrD1GWv01AQ1zu6JZCTVN+ntOcm8UGJ9RTGtPLY0DbANszRMddy1YB yvrR4TkkyPNw1KnQCJ4gmwc9w4TM87EZekE9BguQ6a/mPAU2KMXSsHj87QsYU1Yv JRYl4bGSXZ5TNkcczbsMlQDhxYEZDyNmx0izxC82fMAXE5l2xdypgbTHM7pUxS3b 5FtRoH3hwkV51aha1MyWf0aCjiTQ7nMNb2E9X2EJ+akpzAA6T7ayv6ozzpesZDJj 9ZTvObdjRdqAzAGwcjENUIGA3/srTwnRjK60jj4F9g== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeeftddruddtvddguddvgecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdp uffrtefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecunecujfgurhephffvve fufffkofgggfestdekredtredttdenucfhrhhomhepuehorhhishcuuehurhhkohhvuceo sghorhhishessghurhdrihhoqeenucggtffrrghtthgvrhhnpefgieeuleefffdutdeltd fhtdeuheffveeffeeuiedvtdeihfehveeltdfhgfehjeenucffohhmrghinhepghhithhh uhgsrdgtohhmpdhruhhnrdhshhenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmh epmhgrihhlfhhrohhmpegsohhrihhssegsuhhrrdhiohdpnhgspghrtghpthhtohepfedp mhhouggvpehsmhhtphhouhhtpdhrtghpthhtoheplhhinhhugidqmhhmsehkvhgrtghkrd horhhgpdhrtghpthhtohepfihilhhlhiesihhnfhhrrgguvggrugdrohhrghdprhgtphht thhopehshhgrkhgvvghlrdgsuhhttheslhhinhhugidruggvvh X-ME-Proxy: Feedback-ID: i083147f8:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 13 Aug 2024 14:25:58 -0400 (EDT) From: Boris Burkov To: linux-mm@kvack.org Cc: willy@infradead.org, shakeel.butt@linux.dev Subject: [PATCH RFC] mm: fix refcount check in mapping_evict_folio Date: Tue, 13 Aug 2024 11:25:56 -0700 Message-ID: X-Mailer: git-send-email 2.46.0 MIME-Version: 1.0 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 9CF2E180023 X-Stat-Signature: f5jydajp41m87q8xpudm5b9u3yk1msgq X-Rspam-User: X-HE-Tag: 1723573559-430670 X-HE-Meta: U2FsdGVkX1+9kMr/89Js73yjSs69QNDDd8QVZQ77Xx8yv5FZmdCAY1bbnYHznzncsG6tBzTnU/Vny8TAx7EhrM1eJXqbOYsCp9eJ5KDFL4OGWm1n/k9rc7SpmOPRYL8MmmDuR4sBapb3kxSxOt0J++h51p6qTzu4qK1lXdQTj10JyKbFG75NTpFWo7sma6jF8tnTrk/M6kUMSJvkxs4sUfOr4Ob7ZUtUTaKnTP83YBnlnlKJeI1WkoXR0r6HVWs9EWrfW/VdMU9ydGEEPvTGzfGfR9BYxi9l39Luje8VrWtor189EW86paBfLknBMV2AEaLBO7xZPAaVHg1ayOCCPCPeRelfQgkwd04hI/Ny5mJHCNbxWaXVQZl9ATMtwspxET0/Hp/fzLjxv0EgTQPeQxDxk9H5TyGfIbP9fOzQ2I/Z0hKkViZGuPoP0zrbW1kvut7PL5/m7/oAvPpyHmWCTlynomokiUfx52+u3o6w9oW7R0lQFl/rFjyeL4CrMRAZ/ly+AXsbzujGOKsE3KvJsfJvdW0+NSDlJUX0FYicnmHiw9R/nJiqz/mkZbKqINzMzTRs1ileqx99zd5JobbrLc6nvGYgO9L1PONra0JWacpmMgDWjw2HXQMBYeSS8HcfCetuwOIERvftSbAfAZFSStimLRY2Mdce1xe4Qh1xU0/5Edk97HxNTOjrJnCmi+Hf06s5U7HpOn07cPKgmGajMlbDJP8+LbBZ4Ju6EwX18nOUhkHKdJL01Br8EpbWbeElelpB0uoIXKTrIeiH0EXOTAAytCdFkaxGYxej3sqUPdGcgR3jXaRfMosofYhU+bA6IMin18lqBvVcwV87VvEdEpV9BnGUCTxAQpbUbjfdRZArfelajvRSLvcGDqlFYdkjXouTcA3c5f3UStPAnJFBJfMdLRHl9AE6bS5MdpgvkKfj4xV035loTNncg4My4IVzbK4QWqOF+o5uFTAN6eE dmjilrsy /0CbIRH5xxiuuv3cydwzfiPKf9L3InPqi021n0lrCp6vo3y9+noOjY/PJZL8fNGVbV/q8olsAyJf0BE3KG4APPCQ162yvvYCVFJBbCpnN25zldzudTqF4Buew6QZOtshwmt7Ox1aF1Eqhcx/3qzwgf8kuzoUJKdHZXkZ+vDM0VTJ9+BIzCFFZw06LFuKuE2nr4sLp6B9ftWC0hFeOyyFXHVcWVYKvDbgVQ0AdHCbQswxpg2DEjyMjE7lK1s0WM45Vec2O X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: The commit e41c81d0d30e ("mm/truncate: Replace page_mapped() call in invalidate_inode_page()") replaced the page_mapped(page) check with a refcount check. However, this refcount check does not work as expected with drop_caches, at least for btrfs's metadata pages. Btrfs has a per-sb metadata inode with cached pages, and when not in active use by btrfs, they have a refcount of 3. One from the initial call to alloc_pages, one (nr_pages == 1) from filemap_add_folio, and one from folio_attach_private. We would expect such pages to get dropped by drop_caches. However, drop_caches calls into mapping_evict_folio via mapping_try_invalidate which gets a reference on the folio with find_lock_entries(). As a result, these pages have a refcount of 4, and fail this check. For what it's worth, such pages do get reclaimed under memory pressure, and if I change this refcount check to `if folio_mapped(folio)` The following script produces such pages and uses drgn to further analyze the state of the folios: https://github.com/boryas/scripts/blob/main/sh/strand-meta/run.sh It should at least outline the basic idea for producing some btrfs metadata via creating inlined-extent files. My proposed fix for the issue is to add one more hardcoded refcount to this check to account for the caller having a refcount on the page. However, I am less familiar with the other caller into mapping_evict_folio in the page fault path, so I am concerned this fix will not work properly there, and would appreciate extra scrutiny there. Fixes: e41c81d0d30e ("mm/truncate: Replace page_mapped() call in invalidate_inode_page()") Signed-off-by: Boris Burkov --- mm/truncate.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/mm/truncate.c b/mm/truncate.c index 4d61fbdd4b2f..c710c84710b4 100644 --- a/mm/truncate.c +++ b/mm/truncate.c @@ -267,9 +267,17 @@ long mapping_evict_folio(struct address_space *mapping, struct folio *folio) return 0; if (folio_test_dirty(folio) || folio_test_writeback(folio)) return 0; - /* The refcount will be elevated if any page in the folio is mapped */ + /* + * The refcount will be elevated if any page in the folio is mapped. + * + * The refcounts break down as follows: + * 1 per mapped page + * 1 from folio_attach_private, if private is set + * 1 from allocating the page in the first place + * 1 from the caller + */ if (folio_ref_count(folio) > - folio_nr_pages(folio) + folio_has_private(folio) + 1) + folio_nr_pages(folio) + folio_has_private(folio) + 1 + 1) return 0; if (!filemap_release_folio(folio, 0)) return 0;