Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220215073743.1769979-1-cgel.zte@gmail.com> <1f486393-3829-4618-39a1-931afc580835@oracle.com>
 <d6e74520-88bc-9f57-e189-8e4f389726e@google.com> <Yg5RDDRLVsuT/Rfw@casper.infradead.org>
 <8986d97-3933-8fa7-abba-aabd67924bc2@google.com> <a4f79248-df75-2c8c-3df-ba3317ccb5da@google.com>
In-Reply-To: <a4f79248-df75-2c8c-3df-ba3317ccb5da@google.com>
From:   yong w <yongw.pur@gmail.com>
Date:   Wed, 2 Mar 2022 09:11:08 +0800
Message-ID: <CAOH5QeA4w+CKW+K58k3c5pRWdkx6uT5ouyQ6hepMd1wKF51mcw@mail.gmail.com>
Subject: Re: [PATCH] memfd: fix F_SEAL_WRITE after shmem huge page allocated
To:     Hugh Dickins <hughd@google.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Mike Kravetz <mike.kravetz@oracle.com>,
        Matthew Wilcox <willy@infradead.org>, cgel.zte@gmail.com,
        kirill@shutemov.name, songliubraving@fb.com,
        Linux MM <linux-mm@kvack.org>,
        LKML <linux-kernel@vger.kernel.org>, yang.yang29@zte.com.cn,
        wang.yong12@zte.com.cn
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hello,
this patch does not apply to the 4.19 kernel.
Is it necessary to make corresponding patches for each stable version?

Thanks.

Hugh Dickins <hughd@google.com> =E4=BA=8E2022=E5=B9=B42=E6=9C=8827=E6=97=A5=
=E5=91=A8=E6=97=A5 14:41=E5=86=99=E9=81=93=EF=BC=9A
>
> Wangyong reports: after enabling tmpfs filesystem to support
> transparent hugepage with the following command:
>
>  echo always > /sys/kernel/mm/transparent_hugepage/shmem_enabled
>
> the docker program tries to add F_SEAL_WRITE through the following
> command, but it fails unexpectedly with errno EBUSY:
>
>  fcntl(5, F_ADD_SEALS, F_SEAL_WRITE) =3D -1.
>
> That is because memfd_tag_pins() and memfd_wait_for_pins() were never
> updated for shmem huge pages: checking page_mapcount() against
> page_count() is hopeless on THP subpages - they need to check
> total_mapcount() against page_count() on THP heads only.
>
> Make memfd_tag_pins() (compared > 1) as strict as memfd_wait_for_pins()
> (compared !=3D 1): either can be justified, but given the non-atomic
> total_mapcount() calculation, it is better now to be strict.  Bear in
> mind that total_mapcount() itself scans all of the THP subpages, when
> choosing to take an XA_CHECK_SCHED latency break.
>
> Also fix the unlikely xa_is_value() case in memfd_wait_for_pins(): if a
> page has been swapped out since memfd_tag_pins(), then its refcount must
> have fallen, and so it can safely be untagged.
>
> Reported-by: Zeal Robot <zealci@zte.com.cn>
> Reported-by: wangyong <wang.yong12@zte.com.cn>
> Signed-off-by: Hugh Dickins <hughd@google.com>
> Cc: <stable@vger.kernel.org>
> ---
> Andrew, please remove
> fix-shmem-huge-page-failed-to-set-f_seal_write-attribute-problem.patch
> fix-shmem-huge-page-failed-to-set-f_seal_write-attribute-problem-fix.patc=
h
> from mmotm, and replace them by this patch against 5.17-rc5:
> wangyong's patch did not handle the case of pte-mapped huge pages, and I
> had this one from earlier, when I found the same issue with MFD_HUGEPAGE
> (but MFD_HUGEPAGE did not go in, so I didn't post this one, forgetting
> the transparent_hugepage/shmem_enabled case).
>
>  mm/memfd.c |   40 ++++++++++++++++++++++++++++------------
>  1 file changed, 28 insertions(+), 12 deletions(-)
>
> --- 5.17-rc5/mm/memfd.c
> +++ linux/mm/memfd.c
> @@ -31,20 +31,28 @@
>  static void memfd_tag_pins(struct xa_state *xas)
>  {
>         struct page *page;
> -       unsigned int tagged =3D 0;
> +       int latency =3D 0;
> +       int cache_count;
>
>         lru_add_drain();
>
>         xas_lock_irq(xas);
>         xas_for_each(xas, page, ULONG_MAX) {
> -               if (xa_is_value(page))
> -                       continue;
> -               page =3D find_subpage(page, xas->xa_index);
> -               if (page_count(page) - page_mapcount(page) > 1)
> +               cache_count =3D 1;
> +               if (!xa_is_value(page) &&
> +                   PageTransHuge(page) && !PageHuge(page))
> +                       cache_count =3D HPAGE_PMD_NR;
> +
> +               if (!xa_is_value(page) &&
> +                   page_count(page) - total_mapcount(page) !=3D cache_co=
unt)
>                         xas_set_mark(xas, MEMFD_TAG_PINNED);
> +               if (cache_count !=3D 1)
> +                       xas_set(xas, page->index + cache_count);
>
> -               if (++tagged % XA_CHECK_SCHED)
> +               latency +=3D cache_count;
> +               if (latency < XA_CHECK_SCHED)
>                         continue;
> +               latency =3D 0;
>
>                 xas_pause(xas);
>                 xas_unlock_irq(xas);
> @@ -73,7 +81,8 @@ static int memfd_wait_for_pins(struct ad
>
>         error =3D 0;
>         for (scan =3D 0; scan <=3D LAST_SCAN; scan++) {
> -               unsigned int tagged =3D 0;
> +               int latency =3D 0;
> +               int cache_count;
>
>                 if (!xas_marked(&xas, MEMFD_TAG_PINNED))
>                         break;
> @@ -87,10 +96,14 @@ static int memfd_wait_for_pins(struct ad
>                 xas_lock_irq(&xas);
>                 xas_for_each_marked(&xas, page, ULONG_MAX, MEMFD_TAG_PINN=
ED) {
>                         bool clear =3D true;
> -                       if (xa_is_value(page))
> -                               continue;
> -                       page =3D find_subpage(page, xas.xa_index);
> -                       if (page_count(page) - page_mapcount(page) !=3D 1=
) {
> +
> +                       cache_count =3D 1;
> +                       if (!xa_is_value(page) &&
> +                           PageTransHuge(page) && !PageHuge(page))
> +                               cache_count =3D HPAGE_PMD_NR;
> +
> +                       if (!xa_is_value(page) && cache_count !=3D
> +                           page_count(page) - total_mapcount(page)) {
>                                 /*
>                                  * On the last scan, we clean up all thos=
e tags
>                                  * we inserted; but make a note that we s=
till
> @@ -103,8 +116,11 @@ static int memfd_wait_for_pins(struct ad
>                         }
>                         if (clear)
>                                 xas_clear_mark(&xas, MEMFD_TAG_PINNED);
> -                       if (++tagged % XA_CHECK_SCHED)
> +
> +                       latency +=3D cache_count;
> +                       if (latency < XA_CHECK_SCHED)
>                                 continue;
> +                       latency =3D 0;
>
>                         xas_pause(&xas);
>                         xas_unlock_irq(&xas);