Received-SPF: pass (google.com: domain of linux-kernel+bounces-199333-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Mon, 3 Jun 2024 16:01:25 +0100
From: Matthew Wilcox <willy@infradead.org>
To: David Hildenbrand <david@redhat.com>
Cc: Lance Yang <ioworker0@gmail.com>, akpm@linux-foundation.org,
	ryan.roberts@arm.com, 21cnbao@gmail.com,
	baolin.wang@linux.alibaba.com, ziy@nvidia.com,
	fengwei.yin@intel.com, ying.huang@intel.com, libang.li@antgroup.com,
	linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 1/1] mm/mlock: implement folio_mlock_step() using
 folio_pte_batch()
Message-ID: <Zl3axbhcljTg_X0C@casper.infradead.org>
References: <20240603140745.83880-1-ioworker0@gmail.com>
 <Zl3Wjh9_aGY8Xxm7@casper.infradead.org>
 <c0309ab6-8bae-42b7-8d27-1df895689fb8@redhat.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <c0309ab6-8bae-42b7-8d27-1df895689fb8@redhat.com>

On Mon, Jun 03, 2024 at 04:56:05PM +0200, David Hildenbrand wrote:
> On 03.06.24 16:43, Matthew Wilcox wrote:
> > On Mon, Jun 03, 2024 at 10:07:45PM +0800, Lance Yang wrote:
> > > +++ b/mm/mlock.c
> > > @@ -307,26 +307,15 @@ void munlock_folio(struct folio *folio)
> > >   static inline unsigned int folio_mlock_step(struct folio *folio,
> > >   		pte_t *pte, unsigned long addr, unsigned long end)
> > >   {
> > > -	unsigned int count, i, nr = folio_nr_pages(folio);
> > > -	unsigned long pfn = folio_pfn(folio);
> > > +	const fpb_t fpb_flags = FPB_IGNORE_DIRTY | FPB_IGNORE_SOFT_DIRTY;
> > > +	unsigned int count = (end - addr) >> PAGE_SHIFT;
> > 
> > This is a pre-existing bug, but ... what happens if you're on a 64-bit
> > system and you mlock() a range that is exactly 2^44 bytes?  Seems to me
> > that count becomes 0.  Why not use an unsigned long here and avoid the
> > problem entirely?
> > 
> > folio_pte_batch() also needs to take an unsigned long max_nr in that
> > case, because you aren't restricting it to folio_nr_pages().
> 
> Yeah, likely we should also take a look at other folio_pte_batch() users
> like copy_present_ptes() that pass the count as an int. Nothing should
> really be broken, but we might not batch as much as we could, which is
> unfortunate.

You did include:

        VM_WARN_ON_FOLIO(!folio_test_large(folio) || max_nr < 1, folio);

so at the least we have a userspace-triggerable warning.