[PATCH V3 0/2] JFS: Implement migrate_folio for jfs_metapage_aops

[PATCH V3 0/2] JFS: Implement migrate_folio for jfs_metapage_aops

[Shivank Garg]

This patch addresses a warning that occurs during memory compaction due
to JFS's missing migrate_folio operation. The warning was introduced by
commit 7ee3647 ("migrate: Remove call to ->writepage") which added
explicit warnings when filesystem don't implement migrate_folio.

The syzbot reported following [1]:
  jfs_metapage_aops does not implement migrate_folio
  WARNING: CPU: 1 PID: 5861 at mm/migrate.c:955 fallback_migrate_folio mm/migrate.c:953 [inline]
  WARNING: CPU: 1 PID: 5861 at mm/migrate.c:955 move_to_new_folio+0x70e/0x840 mm/migrate.c:1007
  Modules linked in:
  CPU: 1 UID: 0 PID: 5861 Comm: syz-executor280 Not tainted 6.15.0-rc1-next-20250411-syzkaller #0 PREEMPT(full) 
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
  RIP: 0010:fallback_migrate_folio mm/migrate.c:953 [inline]
  RIP: 0010:move_to_new_folio+0x70e/0x840 mm/migrate.c:1007

This Implement metapage_migrate_folio which handles both single and multiple
metapages per page configurations.

[1]: https://syzkaller.appspot.com/bug?extid=8bb6fd945af4e0ad9299

V1/V2:
https://lore.kernel.org/all/20250413172356.561544-1-shivankg@amd.com

#syz test: https://github.com/AMDESE/linux-mm.git 07246f14ea

Best Regards,
Shivank

Shivank Garg (2):
  mm: export folio_expected_refs for JFS migration handler
  jfs: implement migrate_folio for jfs_metapage_aops

 fs/jfs/jfs_metapage.c   | 94 +++++++++++++++++++++++++++++++++++++++++
 include/linux/migrate.h |  1 +
 mm/migrate.c            |  3 +-
 3 files changed, 97 insertions(+), 1 deletion(-)

-- 
2.34.1

[PATCH V3 1/2] mm: export folio_expected_refs for JFS migration handler

[Shivank Garg]

Export folio_expected_refs() to allow filesystem-specific migration
handlers like JFS metapage_migrate_folio to properly verify reference
counts before migration.

Signed-off-by: Shivank Garg <shivankg@amd.com>
---
 include/linux/migrate.h | 1 +
 mm/migrate.c            | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/linux/migrate.h b/include/linux/migrate.h
index aaa2114498d6..cb31c5b1eb6a 100644
--- a/include/linux/migrate.h
+++ b/include/linux/migrate.h
@@ -60,6 +60,7 @@ struct movable_operations {
 /* Defined in mm/debug.c: */
 extern const char *migrate_reason_names[MR_TYPES];
 
+int folio_expected_refs(struct address_space *mapping, struct folio *folio);
 #ifdef CONFIG_MIGRATION
 
 void putback_movable_pages(struct list_head *l);
diff --git a/mm/migrate.c b/mm/migrate.c
index 6e2488e5dbe4..0f01b8a87dec 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -445,7 +445,7 @@ void pmd_migration_entry_wait(struct mm_struct *mm, pmd_t *pmd)
 }
 #endif
 
-static int folio_expected_refs(struct address_space *mapping,
+int folio_expected_refs(struct address_space *mapping,
 		struct folio *folio)
 {
 	int refs = 1;
@@ -458,6 +458,7 @@ static int folio_expected_refs(struct address_space *mapping,
 
 	return refs;
 }
+EXPORT_SYMBOL_GPL(folio_expected_refs);
 
 /*
  * Replace the folio in the mapping.
-- 
2.34.1

[PATCH V3 2/2] jfs: implement migrate_folio for jfs_metapage_aops

[Shivank Garg]

Add the missing migrate_folio operation to jfs_metapage_aops to fix
warnings during memory compaction. These warnings were introduced by
commit 7ee3647243e5 ("migrate: Remove call to ->writepage") which
added explicit warnings when filesystems don't implement migrate_folio.

System reports following warnings:
  jfs_metapage_aops does not implement migrate_folio
  WARNING: CPU: 0 PID: 6870 at mm/migrate.c:955 fallback_migrate_folio mm/migrate.c:953 [inline]
  WARNING: CPU: 0 PID: 6870 at mm/migrate.c:955 move_to_new_folio+0x70e/0x840 mm/migrate.c:1007

Implement metapage_migrate_folio which handles both single and multiple
metapages per page configurations.

Fixes: 35474d52c605 ("jfs: Convert metapage_writepage to metapage_write_folio")
Reported-by: syzbot+8bb6fd945af4e0ad9299@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67faff52.050a0220.379d84.001b.GAE@google.com
Signed-off-by: Shivank Garg <shivankg@amd.com>
---
 fs/jfs/jfs_metapage.c | 94 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)

diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index df575a873ec6..8bf33c0a1b8c 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -15,6 +15,7 @@
 #include <linux/mempool.h>
 #include <linux/seq_file.h>
 #include <linux/writeback.h>
+#include <linux/migrate.h>
 #include "jfs_incore.h"
 #include "jfs_superblock.h"
 #include "jfs_filsys.h"
@@ -151,6 +152,54 @@ static inline void dec_io(struct folio *folio, blk_status_t status,
 		handler(folio, anchor->status);
 }
 
+static int __metapage_migrate_folio(struct address_space *mapping, struct folio *dst,
+				    struct folio *src, enum migrate_mode mode)
+{
+	struct meta_anchor *src_anchor = src->private;
+	struct metapage *mps[MPS_PER_PAGE] = {0};
+	struct metapage *mp;
+	int i, rc;
+
+	for (i = 0; i < MPS_PER_PAGE; i++) {
+		mp = src_anchor->mp[i];
+		if (mp && metapage_locked(mp))
+			return -EAGAIN;
+	}
+
+	rc = filemap_migrate_folio(mapping, dst, src, mode);
+	if (rc != MIGRATEPAGE_SUCCESS)
+		return rc;
+
+	for (i = 0; i < MPS_PER_PAGE; i++) {
+		mp = src_anchor->mp[i];
+		if (!mp)
+			continue;
+		if (unlikely(insert_metapage(dst, mp))) {
+			/* If error, roll-back previosly inserted pages */
+			for (int j = 0 ; j < i; j++) {
+				if (mps[j])
+					remove_metapage(dst, mps[j]);
+			}
+			return -EAGAIN;
+		}
+		mps[i] = mp;
+	}
+
+	/* Update the metapage and remove it from src */
+	for (i = 0; i < MPS_PER_PAGE; i++) {
+		mp = mps[i];
+		if (mp) {
+			int page_offset = mp->data - folio_address(src);
+
+			mp->data = folio_address(dst) + page_offset;
+			mp->folio = dst;
+			remove_metapage(src, mp);
+		}
+	}
+
+	return MIGRATEPAGE_SUCCESS;
+}
+
 #else
 static inline struct metapage *folio_to_mp(struct folio *folio, int offset)
 {
@@ -175,6 +224,32 @@ static inline void remove_metapage(struct folio *folio, struct metapage *mp)
 #define inc_io(folio) do {} while(0)
 #define dec_io(folio, status, handler) handler(folio, status)
 
+static int __metapage_migrate_folio(struct address_space *mapping, struct folio *dst,
+				    struct folio *src, enum migrate_mode mode)
+{
+	struct metapage *mp;
+	int page_offset;
+	int rc;
+
+	mp = folio_to_mp(src, 0);
+	if (mp && metapage_locked(mp))
+		return -EAGAIN;
+
+	rc = filemap_migrate_folio(mapping, dst, src, mode);
+	if (rc != MIGRATEPAGE_SUCCESS)
+		return rc;
+
+	if (unlikely(insert_metapage(dst, mp)))
+		return -EAGAIN;
+
+	page_offset = mp->data - folio_address(src);
+	mp->data = folio_address(dst) + page_offset;
+	mp->folio = dst;
+	remove_metapage(src, mp);
+
+	return MIGRATEPAGE_SUCCESS;
+}
+
 #endif
 
 static inline struct metapage *alloc_metapage(gfp_t gfp_mask)
@@ -554,6 +629,24 @@ static bool metapage_release_folio(struct folio *folio, gfp_t gfp_mask)
 	return ret;
 }
 
+/**
+ * metapage_migrate_folio - Migration function for JFS metapages
+ */
+static int metapage_migrate_folio(struct address_space *mapping, struct folio *dst,
+				  struct folio *src, enum migrate_mode mode)
+{
+	int expected_count;
+
+	if (!src->private)
+		return filemap_migrate_folio(mapping, dst, src, mode);
+
+	/* Check whether page does not have extra refs before we do more work */
+	expected_count = folio_expected_refs(mapping, src);
+	if (folio_ref_count(src) != expected_count)
+		return -EAGAIN;
+	return __metapage_migrate_folio(mapping, dst, src, mode);
+}
+
 static void metapage_invalidate_folio(struct folio *folio, size_t offset,
 				    size_t length)
 {
@@ -570,6 +663,7 @@ const struct address_space_operations jfs_metapage_aops = {
 	.release_folio	= metapage_release_folio,
 	.invalidate_folio = metapage_invalidate_folio,
 	.dirty_folio	= filemap_dirty_folio,
+	.migrate_folio	= metapage_migrate_folio,
 };
 
 struct metapage *__get_metapage(struct inode *inode, unsigned long lblock,
-- 
2.34.1

Re: [PATCH V3 1/2] mm: export folio_expected_refs for JFS migration handler

[David Hildenbrand]

On 17.04.25 08:06, Shivank Garg wrote:
> Export folio_expected_refs() to allow filesystem-specific migration
> handlers like JFS metapage_migrate_folio to properly verify reference
> counts before migration.
> 
> Signed-off-by: Shivank Garg <shivankg@amd.com>
> ---
>   include/linux/migrate.h | 1 +
>   mm/migrate.c            | 3 ++-
>   2 files changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/migrate.h b/include/linux/migrate.h
> index aaa2114498d6..cb31c5b1eb6a 100644
> --- a/include/linux/migrate.h
> +++ b/include/linux/migrate.h
> @@ -60,6 +60,7 @@ struct movable_operations {
>   /* Defined in mm/debug.c: */
>   extern const char *migrate_reason_names[MR_TYPES];
>   
> +int folio_expected_refs(struct address_space *mapping, struct folio *folio);
>   #ifdef CONFIG_MIGRATION
>   
>   void putback_movable_pages(struct list_head *l);
> diff --git a/mm/migrate.c b/mm/migrate.c
> index 6e2488e5dbe4..0f01b8a87dec 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -445,7 +445,7 @@ void pmd_migration_entry_wait(struct mm_struct *mm, pmd_t *pmd)
>   }
>   #endif
>   
> -static int folio_expected_refs(struct address_space *mapping,
> +int folio_expected_refs(struct address_space *mapping,
>   		struct folio *folio)
>   {
>   	int refs = 1;
> @@ -458,6 +458,7 @@ static int folio_expected_refs(struct address_space *mapping,
>   
>   	return refs;
>   }
> +EXPORT_SYMBOL_GPL(folio_expected_refs);
>   
>   /*
>    * Replace the folio in the mapping.

Can we make that an inline function instead, and add some documentation?

This function is only suitable if we know the folio is unmapped from 
page tables (no references from page table mappings: !folio_mapped()).

So when exporting this function we either

a) Need a clearer name

b) Should generalize it to consider folio_mapcount() etc, and lookup the
    mapping from the folio.

For your use case, a) might be easier. Maybe call  it something like 
"folio_migration_expected_refs" ?

-- 
Cheers,

David / dhildenb

Re: [syzbot] [mm?] WARNING in move_to_new_folio

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

tes for 255 objects at 0xffff88823be00000-0xffff88823c000000
[    1.925837][    T0] Console: colour VGA+ 80x25
[    1.926854][    T0] printk: legacy console [ttyS0] enabled
[    1.926854][    T0] printk: legacy console [ttyS0] enabled
[    1.928807][    T0] printk: legacy bootconsole [earlyser0] disabled
[    1.928807][    T0] printk: legacy bootconsole [earlyser0] disabled
[    1.931060][    T0] Lock dependency validator: Copyright (c) 2006 Red Hat, Inc., Ingo Molnar
[    1.932421][    T0] ... MAX_LOCKDEP_SUBCLASSES:  8
[    1.933470][    T0] ... MAX_LOCK_DEPTH:          48
[    1.934392][    T0] ... MAX_LOCKDEP_KEYS:        8192
[    1.935279][    T0] ... CLASSHASH_SIZE:          4096
[    1.936068][    T0] ... MAX_LOCKDEP_ENTRIES:     1048576
[    1.937188][    T0] ... MAX_LOCKDEP_CHAINS:      1048576
[    1.938022][    T0] ... CHAINHASH_SIZE:          524288
[    1.938854][    T0]  memory used by lock dependency info: 106625 kB
[    1.940170][    T0]  memory used for stack traces: 8320 kB
[    1.941640][    T0]  per task-struct memory footprint: 1920 bytes
[    1.942814][    T0] mempolicy: Enabling automatic NUMA balancing. Configure with numa_balancing= or the kernel.numa_balancing sysctl
[    1.945209][    T0] ACPI: Core revision 20241212
[    1.946927][    T0] APIC: Switch to symmetric I/O mode setup
[    1.948578][    T0] x2apic enabled
[    1.953337][    T0] APIC: Switched APIC routing to: physical x2apic
[    1.960868][    T0] ..TIMER: vector=0x30 apic1=0 pin1=0 apic2=-1 pin2=-1
[    1.963220][    T0] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x1fb6f76ef03, max_idle_ns: 440795255960 ns
[    1.965573][    T0] Calibrating delay loop (skipped) preset value.. 4400.41 BogoMIPS (lpj=22002080)
[    1.976248][    T0] Last level iTLB entries: 4KB 64, 2MB 8, 4MB 8
[    1.977543][    T0] Last level dTLB entries: 4KB 64, 2MB 32, 4MB 32, 1GB 4
[    1.978831][    T0] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[    1.981126][    T0] Spectre V2 : Spectre BHI mitigation: SW BHB clearing on syscall and VM exit
[    1.983233][    T0] Spectre V2 : Mitigation: IBRS
[    1.983963][    T0] Spectre V2 : Spectre v2 / SpectreRSB: Filling RSB on context switch and VMEXIT
[    1.985668][    T0] RETBleed: Mitigation: IBRS
[    1.986468][    T0] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[    1.987833][    T0] Spectre V2 : User space: Mitigation: STIBP via prctl
[    1.989023][    T0] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
[    1.990381][    T0] MDS: Mitigation: Clear CPU buffers
[    1.991105][    T0] TAA: Mitigation: Clear CPU buffers
[    1.992276][    T0] MMIO Stale Data: Vulnerable: Clear CPU buffers attempted, no microcode
[    1.993752][    T0] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[    1.994963][    T0] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[    1.995572][    T0] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[    1.996652][    T0] x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
[    1.997837][    T0] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format.
[    2.295143][    T0] Freeing SMP alternatives memory: 132K
[    2.295587][    T0] pid_max: default: 32768 minimum: 301
[    2.297541][    T0] LSM: initializing lsm=lockdown,capability,landlock,yama,safesetid,tomoyo,apparmor,bpf,ima,evm
[    2.300386][    T0] landlock: Up and running.
[    2.301189][    T0] Yama: becoming mindful.
[    2.302225][    T0] TOMOYO Linux initialized
[    2.303858][    T0] AppArmor: AppArmor initialized
[    2.307123][    T0] LSM support for eBPF active
[    2.314189][    T0] Dentry cache hash table entries: 1048576 (order: 11, 8388608 bytes, vmalloc hugepage)
[    2.318576][    T0] Inode-cache hash table entries: 524288 (order: 10, 4194304 bytes, vmalloc hugepage)
[    2.320554][    T0] Mount-cache hash table entries: 16384 (order: 5, 131072 bytes, vmalloc)
[    2.322439][    T0] Mountpoint-cache hash table entries: 16384 (order: 5, 131072 bytes, vmalloc)
[    2.330329][    T0] Running RCU synchronous self tests
[    2.331252][    T0] Running RCU synchronous self tests
[    2.453357][    T1] smpboot: CPU0: Intel(R) Xeon(R) CPU @ 2.20GHz (family: 0x6, model: 0x4f, stepping: 0x0)
[    2.455556][    T9] ------------[ cut here ]------------
[    2.455556][    T9] WARNING: CPU: 0 PID: 9 at arch/x86/mm/tlb.c:919 switch_mm_irqs_off+0x686/0x810
[    2.455556][    T9] Modules linked in:
[    2.455556][    T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.15.0-rc2-next-20250416-syzkaller-04531-g07246f14ea38 #0 PREEMPT(full) 
[    2.455556][    T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[    2.455556][    T9] Workqueue: events once_deferred
[    2.455556][    T9] RIP: 0010:switch_mm_irqs_off+0x686/0x810
[    2.455556][    T9] Code: 90 41 f7 c5 00 08 00 00 0f 84 ee fa ff ff 90 0f 0b 90 e9 e5 fa ff ff 90 0f 0b 90 e9 76 fe ff ff 90 0f 0b 90 e9 cc fb ff ff 90 <0f> 0b 90 4d 39 f4 0f 85 eb fb ff ff e9 31 fc ff ff 90 0f 0b 90 e9
[    2.455556][    T9] RSP: 0000:ffffc900000e7680 EFLAGS: 00010056
[    2.455556][    T9] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff816ffd4d
[    2.455556][    T9] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88801b070940
[    2.455556][    T9] RBP: ffffc900000e7750 R08: ffff88801b070947 R09: 1ffff1100360e128
[    2.455556][    T9] R10: dffffc0000000000 R11: ffffed100360e129 R12: ffffffff8ee492c0
[    2.455556][    T9] R13: ffff88801b070940 R14: ffffffff8ee492c0 R15: 0000000000000000
[    2.455556][    T9] FS:  0000000000000000(0000) GS:ffff888124f9c000(0000) knlGS:0000000000000000
[    2.455556][    T9] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.455556][    T9] CR2: ffff88823ffff000 CR3: 000000001b078000 CR4: 00000000003506f0
[    2.455556][    T9] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    2.455556][    T9] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    2.455556][    T9] Call Trace:
[    2.455556][    T9]  <TASK>
[    2.455556][    T9]  ? __pfx_switch_mm_irqs_off+0x10/0x10
[    2.455556][    T9]  ? __text_poke+0x6bb/0xb40
[    2.455556][    T9]  ? kasan_check_range+0x28f/0x2a0
[    2.455556][    T9]  ? serial8250_isa_init_ports+0x6b/0x110
[    2.455556][    T9]  unuse_temporary_mm+0x9f/0x100
[    2.455556][    T9]  __text_poke+0x7b6/0xb40
[    2.455556][    T9]  ? serial8250_isa_init_ports+0x6b/0x110
[    2.455556][    T9]  ? __pfx_text_poke_memcpy+0x10/0x10
[    2.455556][    T9]  ? __pfx___text_poke+0x10/0x10
[    2.455556][    T9]  ? __pfx___mutex_trylock_common+0x10/0x10
[    2.455556][    T9]  ? __pfx___might_resched+0x10/0x10
[    2.455556][    T9]  ? rcu_is_watching+0x15/0xb0
[    2.455556][    T9]  smp_text_poke_batch_finish+0x3e7/0x12c0
[    2.455556][    T9]  ? arch_jump_label_transform_apply+0x17/0x30
[    2.455556][    T9]  ? __pfx___mutex_lock+0x10/0x10
[    2.455556][    T9]  ? __pfx_smp_text_poke_batch_finish+0x10/0x10
[    2.455556][    T9]  ? arch_jump_label_transform_queue+0x9b/0x100
[    2.455556][    T9]  ? __jump_label_update+0x387/0x3b0
[    2.455556][    T9]  arch_jump_label_transform_apply+0x1c/0x30
[    2.455556][    T9]  static_key_disable_cpuslocked+0xd2/0x1c0
[    2.455556][    T9]  static_key_disable+0x1a/0x20
[    2.455556][    T9]  once_deferred+0x70/0xb0
[    2.455556][    T9]  ? process_scheduled_works+0x9cb/0x18e0
[    2.455556][    T9]  process_scheduled_works+0xac3/0x18e0
[    2.455556][    T9]  ? __pfx_process_scheduled_works+0x10/0x10
[    2.455556][    T9]  ? assign_work+0x367/0x3d0
[    2.455556][    T9]  worker_thread+0x870/0xd50
[    2.455556][    T9]  ? __kthread_parkme+0x1a8/0x200
[    2.455556][    T9]  ? __pfx_worker_thread+0x10/0x10
[    2.455556][    T9]  kthread+0x7b7/0x940
[    2.455556][    T9]  ? __pfx_worker_thread+0x10/0x10
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ? _raw_spin_unlock_irq+0x23/0x50
[    2.455556][    T9]  ? lockdep_hardirqs_on+0x9d/0x150
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ret_from_fork+0x4b/0x80
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ret_from_fork_asm+0x1a/0x30
[    2.455556][    T9]  </TASK>
[    2.455556][    T9] Kernel panic - not syncing: kernel: panic_on_warn set ...
[    2.455556][    T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.15.0-rc2-next-20250416-syzkaller-04531-g07246f14ea38 #0 PREEMPT(full) 
[    2.455556][    T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[    2.455556][    T9] Workqueue: events once_deferred
[    2.455556][    T9] Call Trace:
[    2.455556][    T9]  <TASK>
[    2.455556][    T9]  dump_stack_lvl+0x241/0x360
[    2.455556][    T9]  ? __pfx_dump_stack_lvl+0x10/0x10
[    2.455556][    T9]  ? __pfx__printk+0x10/0x10
[    2.455556][    T9]  ? vscnprintf+0x5d/0x90
[    2.455556][    T9]  panic+0x349/0x880
[    2.455556][    T9]  ? __warn+0x174/0x4d0
[    2.455556][    T9]  ? __pfx_panic+0x10/0x10
[    2.455556][    T9]  ? ret_from_fork_asm+0x1a/0x30
[    2.455556][    T9]  __warn+0x344/0x4d0
[    2.455556][    T9]  ? switch_mm_irqs_off+0x686/0x810
[    2.455556][    T9]  report_bug+0x2b3/0x500
[    2.455556][    T9]  ? switch_mm_irqs_off+0x686/0x810
[    2.455556][    T9]  ? switch_mm_irqs_off+0x686/0x810
[    2.455556][    T9]  ? switch_mm_irqs_off+0x688/0x810
[    2.455556][    T9]  handle_bug+0x89/0x170
[    2.455556][    T9]  exc_invalid_op+0x1a/0x50
[    2.455556][    T9]  asm_exc_invalid_op+0x1a/0x20
[    2.455556][    T9] RIP: 0010:switch_mm_irqs_off+0x686/0x810
[    2.455556][    T9] Code: 90 41 f7 c5 00 08 00 00 0f 84 ee fa ff ff 90 0f 0b 90 e9 e5 fa ff ff 90 0f 0b 90 e9 76 fe ff ff 90 0f 0b 90 e9 cc fb ff ff 90 <0f> 0b 90 4d 39 f4 0f 85 eb fb ff ff e9 31 fc ff ff 90 0f 0b 90 e9
[    2.455556][    T9] RSP: 0000:ffffc900000e7680 EFLAGS: 00010056
[    2.455556][    T9] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff816ffd4d
[    2.455556][    T9] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88801b070940
[    2.455556][    T9] RBP: ffffc900000e7750 R08: ffff88801b070947 R09: 1ffff1100360e128
[    2.455556][    T9] R10: dffffc0000000000 R11: ffffed100360e129 R12: ffffffff8ee492c0
[    2.455556][    T9] R13: ffff88801b070940 R14: ffffffff8ee492c0 R15: 0000000000000000
[    2.455556][    T9]  ? switch_mm_irqs_off+0x26d/0x810
[    2.455556][    T9]  ? __pfx_switch_mm_irqs_off+0x10/0x10
[    2.455556][    T9]  ? __text_poke+0x6bb/0xb40
[    2.455556][    T9]  ? kasan_check_range+0x28f/0x2a0
[    2.455556][    T9]  ? serial8250_isa_init_ports+0x6b/0x110
[    2.455556][    T9]  unuse_temporary_mm+0x9f/0x100
[    2.455556][    T9]  __text_poke+0x7b6/0xb40
[    2.455556][    T9]  ? serial8250_isa_init_ports+0x6b/0x110
[    2.455556][    T9]  ? __pfx_text_poke_memcpy+0x10/0x10
[    2.455556][    T9]  ? __pfx___text_poke+0x10/0x10
[    2.455556][    T9]  ? __pfx___mutex_trylock_common+0x10/0x10
[    2.455556][    T9]  ? __pfx___might_resched+0x10/0x10
[    2.455556][    T9]  ? rcu_is_watching+0x15/0xb0
[    2.455556][    T9]  smp_text_poke_batch_finish+0x3e7/0x12c0
[    2.455556][    T9]  ? arch_jump_label_transform_apply+0x17/0x30
[    2.455556][    T9]  ? __pfx___mutex_lock+0x10/0x10
[    2.455556][    T9]  ? __pfx_smp_text_poke_batch_finish+0x10/0x10
[    2.455556][    T9]  ? arch_jump_label_transform_queue+0x9b/0x100
[    2.455556][    T9]  ? __jump_label_update+0x387/0x3b0
[    2.455556][    T9]  arch_jump_label_transform_apply+0x1c/0x30
[    2.455556][    T9]  static_key_disable_cpuslocked+0xd2/0x1c0
[    2.455556][    T9]  static_key_disable+0x1a/0x20
[    2.455556][    T9]  once_deferred+0x70/0xb0
[    2.455556][    T9]  ? process_scheduled_works+0x9cb/0x18e0
[    2.455556][    T9]  process_scheduled_works+0xac3/0x18e0
[    2.455556][    T9]  ? __pfx_process_scheduled_works+0x10/0x10
[    2.455556][    T9]  ? assign_work+0x367/0x3d0
[    2.455556][    T9]  worker_thread+0x870/0xd50
[    2.455556][    T9]  ? __kthread_parkme+0x1a8/0x200
[    2.455556][    T9]  ? __pfx_worker_thread+0x10/0x10
[    2.455556][    T9]  kthread+0x7b7/0x940
[    2.455556][    T9]  ? __pfx_worker_thread+0x10/0x10
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ? _raw_spin_unlock_irq+0x23/0x50
[    2.455556][    T9]  ? lockdep_hardirqs_on+0x9d/0x150
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ret_from_fork+0x4b/0x80
[    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
[    2.455556][    T9]  ret_from_fork_asm+0x1a/0x30
[    2.455556][    T9]  </TASK>
[    2.455556][    T9] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.7.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.7.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.7'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1450323150=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 0bd6db4180
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=0bd6db418098e2d98a2edf948b41410d3d9f9e70 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250411-130225'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"0bd6db418098e2d98a2edf948b41410d3d9f9e70\"
/usr/bin/ld: /tmp/ccXxW6Eo.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=14fe3a3f980000


Tested on:

commit:         07246f14 jfs: implement migrate_folio for jfs_metapage..
git tree:       https://github.com/AMDESE/linux-mm.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=361d80851af850ed
dashboard link: https://syzkaller.appspot.com/bug?extid=8bb6fd945af4e0ad9299
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.

Re: [syzbot] [mm?] WARNING in move_to_new_folio

[Shivank Garg]

On 4/17/2025 2:17 PM, syzbot wrote:
> Hello,
> 
> syzbot tried to test the proposed patch but the build/boot failed:
> 
...
> [    2.455556][    T9] ------------[ cut here ]------------
> [    2.455556][    T9] WARNING: CPU: 0 PID: 9 at arch/x86/mm/tlb.c:919 switch_mm_irqs_off+0x686/0x810
> [    2.455556][    T9] Modules linked in:
> [    2.455556][    T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.15.0-rc2-next-20250416-syzkaller-04531-g07246f14ea38 #0 PREEMPT(full) 
> [    2.455556][    T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
> [    2.455556][    T9] Workqueue: events once_deferred
> [    2.455556][    T9] RIP: 0010:switch_mm_irqs_off+0x686/0x810
> [    2.455556][    T9] Code: 90 41 f7 c5 00 08 00 00 0f 84 ee fa ff ff 90 0f 0b 90 e9 e5 fa ff ff 90 0f 0b 90 e9 76 fe ff ff 90 0f 0b 90 e9 cc fb ff ff 90 <0f> 0b 90 4d 39 f4 0f 85 eb fb ff ff e9 31 fc ff ff 90 0f 0b 90 e9
> [    2.455556][    T9] RSP: 0000:ffffc900000e7680 EFLAGS: 00010056
> [    2.455556][    T9] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff816ffd4d
> [    2.455556][    T9] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88801b070940
> [    2.455556][    T9] RBP: ffffc900000e7750 R08: ffff88801b070947 R09: 1ffff1100360e128
> [    2.455556][    T9] R10: dffffc0000000000 R11: ffffed100360e129 R12: ffffffff8ee492c0
> [    2.455556][    T9] R13: ffff88801b070940 R14: ffffffff8ee492c0 R15: 0000000000000000
> [    2.455556][    T9] FS:  0000000000000000(0000) GS:ffff888124f9c000(0000) knlGS:0000000000000000
> [    2.455556][    T9] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    2.455556][    T9] CR2: ffff88823ffff000 CR3: 000000001b078000 CR4: 00000000003506f0
> [    2.455556][    T9] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [    2.455556][    T9] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [    2.455556][    T9] Call Trace:
> [    2.455556][    T9]  <TASK>
> [    2.455556][    T9]  ? __pfx_switch_mm_irqs_off+0x10/0x10
> [    2.455556][    T9]  ? __text_poke+0x6bb/0xb40
> [    2.455556][    T9]  ? kasan_check_range+0x28f/0x2a0
> [    2.455556][    T9]  ? serial8250_isa_init_ports+0x6b/0x110
> [    2.455556][    T9]  unuse_temporary_mm+0x9f/0x100
> [    2.455556][    T9]  __text_poke+0x7b6/0xb40
> [    2.455556][    T9]  ? serial8250_isa_init_ports+0x6b/0x110
> [    2.455556][    T9]  ? __pfx_text_poke_memcpy+0x10/0x10
> [    2.455556][    T9]  ? __pfx___text_poke+0x10/0x10
> [    2.455556][    T9]  ? __pfx___mutex_trylock_common+0x10/0x10
> [    2.455556][    T9]  ? __pfx___might_resched+0x10/0x10
> [    2.455556][    T9]  ? rcu_is_watching+0x15/0xb0
> [    2.455556][    T9]  smp_text_poke_batch_finish+0x3e7/0x12c0
> [    2.455556][    T9]  ? arch_jump_label_transform_apply+0x17/0x30
> [    2.455556][    T9]  ? __pfx___mutex_lock+0x10/0x10
> [    2.455556][    T9]  ? __pfx_smp_text_poke_batch_finish+0x10/0x10
> [    2.455556][    T9]  ? arch_jump_label_transform_queue+0x9b/0x100
> [    2.455556][    T9]  ? __jump_label_update+0x387/0x3b0
> [    2.455556][    T9]  arch_jump_label_transform_apply+0x1c/0x30
> [    2.455556][    T9]  static_key_disable_cpuslocked+0xd2/0x1c0
> [    2.455556][    T9]  static_key_disable+0x1a/0x20
> [    2.455556][    T9]  once_deferred+0x70/0xb0
> [    2.455556][    T9]  ? process_scheduled_works+0x9cb/0x18e0
> [    2.455556][    T9]  process_scheduled_works+0xac3/0x18e0
> [    2.455556][    T9]  ? __pfx_process_scheduled_works+0x10/0x10
> [    2.455556][    T9]  ? assign_work+0x367/0x3d0
> [    2.455556][    T9]  worker_thread+0x870/0xd50
> [    2.455556][    T9]  ? __kthread_parkme+0x1a8/0x200
> [    2.455556][    T9]  ? __pfx_worker_thread+0x10/0x10
> [    2.455556][    T9]  kthread+0x7b7/0x940
> [    2.455556][    T9]  ? __pfx_worker_thread+0x10/0x10
> [    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
> [    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
> [    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
> [    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
> [    2.455556][    T9]  ? _raw_spin_unlock_irq+0x23/0x50
> [    2.455556][    T9]  ? lockdep_hardirqs_on+0x9d/0x150
> [    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
> [    2.455556][    T9]  ret_from_fork+0x4b/0x80
> [    2.455556][    T9]  ? __pfx_kthread+0x10/0x10
> [    2.455556][    T9]  ret_from_fork_asm+0x1a/0x30
> [    2.455556][    T9]  </TASK>
> [    2.455556][    T9] Kernel panic - not syncing: kernel: panic_on_warn set ...

This is some unrelated regression issue. Also, reported here:
https://lore.kernel.org/all/SJ1PR11MB6129E62E3B372932C6B7477FB9BD2@SJ1PR11MB6129.namprd11.prod.outlook.com
https://lore.kernel.org/all/67fce34b.050a0220.3483fc.0026.GAE@google.com


Thanks,
Shivank

Re: [PATCH V3 1/2] mm: export folio_expected_refs for JFS migration handler

[Shivank Garg]

On 4/17/2025 2:10 PM, David Hildenbrand wrote:
> On 17.04.25 08:06, Shivank Garg wrote:
>> Export folio_expected_refs() to allow filesystem-specific migration
>> handlers like JFS metapage_migrate_folio to properly verify reference
>> counts before migration.
>>
>> Signed-off-by: Shivank Garg <shivankg@amd.com>
>> ---
>>   include/linux/migrate.h | 1 +
>>   mm/migrate.c            | 3 ++-
>>   2 files changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/linux/migrate.h b/include/linux/migrate.h
>> index aaa2114498d6..cb31c5b1eb6a 100644
>> --- a/include/linux/migrate.h
>> +++ b/include/linux/migrate.h
>> @@ -60,6 +60,7 @@ struct movable_operations {
>>   /* Defined in mm/debug.c: */
>>   extern const char *migrate_reason_names[MR_TYPES];
>>   +int folio_expected_refs(struct address_space *mapping, struct folio *folio);
>>   #ifdef CONFIG_MIGRATION
>>     void putback_movable_pages(struct list_head *l);
>> diff --git a/mm/migrate.c b/mm/migrate.c
>> index 6e2488e5dbe4..0f01b8a87dec 100644
>> --- a/mm/migrate.c
>> +++ b/mm/migrate.c
>> @@ -445,7 +445,7 @@ void pmd_migration_entry_wait(struct mm_struct *mm, pmd_t *pmd)
>>   }
>>   #endif
>>   -static int folio_expected_refs(struct address_space *mapping,
>> +int folio_expected_refs(struct address_space *mapping,
>>           struct folio *folio)
>>   {
>>       int refs = 1;
>> @@ -458,6 +458,7 @@ static int folio_expected_refs(struct address_space *mapping,
>>         return refs;
>>   }
>> +EXPORT_SYMBOL_GPL(folio_expected_refs);
>>     /*
>>    * Replace the folio in the mapping.
> 
> Can we make that an inline function instead, and add some documentation?
> 
> This function is only suitable if we know the folio is unmapped from page tables (no references from page table mappings: !folio_mapped()).
> 
> So when exporting this function we either
> 
> a) Need a clearer name
> 
> b) Should generalize it to consider folio_mapcount() etc, and lookup the
>    mapping from the folio.
> 
> For your use case, a) might be easier. Maybe call  it something like "folio_migration_expected_refs" ?
> 

Thank you David for the review. I'll make it a static inline function in the header file
with proper documentation. I don't need to EXPORT it then, since it will be an inline function.

Best Regards,
Shivank