Re: [PATCH 1/3] xfs: Remove xfs_filemap_map_pages() wrapper

[Matthew Wilcox <willy@infradead.org>]

On Wed, Feb 08, 2023 at 08:39:19AM -0800, Darrick J. Wong wrote:
> On Wed, Feb 08, 2023 at 02:53:33PM +0000, Matthew Wilcox (Oracle) wrote:
> > XFS doesn't actually need to be holding the XFS_MMAPLOCK_SHARED
> > to do this, any more than it needs the XFS_MMAPLOCK_SHARED for a
> > read() that hits in the page cache.
> 
> Hmm.  From commit cd647d5651c0 ("xfs: use MMAPLOCK around
> filemap_map_pages()"):
> 
>     The page faultround path ->map_pages is implemented in XFS via
>     filemap_map_pages(). This function checks that pages found in page
>     cache lookups have not raced with truncate based invalidation by
>     checking page->mapping is correct and page->index is within EOF.
> 
>     However, we've known for a long time that this is not sufficient to
>     protect against races with invalidations done by operations that do
>     not change EOF. e.g. hole punching and other fallocate() based
>     direct extent manipulations. The way we protect against these
>     races is we wrap the page fault operations in a XFS_MMAPLOCK_SHARED
>     lock so they serialise against fallocate and truncate before calling
>     into the filemap function that processes the fault.
> 
>     Do the same for XFS's ->map_pages implementation to close this
>     potential data corruption issue.
> 
> How do we prevent faultaround from racing with fallocate and reflink
> calls that operate below EOF?

I don't understand the commit message.  It'd be nice to have an example
of what's insufficient about the protection.  If XFS really needs it,
it can trylock the semaphore and return 0 if it fails, falling back to
the ->fault path.  But I don't think XFS actually needs it.

The ->map_pages path trylocks the folio, checks the folio->mapping,
checks uptodate, then checks beyond EOF (not relevant to hole punch).
Then it takes the page table lock and puts the page(s) into the page
tables, unlocks the folio and moves on to the next folio.

The hole-punch path, like the truncate path, takes the folio lock,
unmaps the folio (which will take the page table lock) and removes
it from the page cache.

So what's the race?