* [PATCH V5 1/2] mm: Add folio_expected_ref_count() for reference count calculation
2025-04-30 10:01 [PATCH V5 0/2] JFS: Implement migrate_folio for jfs_metapage_aops Shivank Garg
@ 2025-04-30 10:01 ` Shivank Garg
2025-04-30 10:01 ` [PATCH V5 2/2] jfs: implement migrate_folio for jfs_metapage_aops Shivank Garg
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Shivank Garg @ 2025-04-30 10:01 UTC (permalink / raw)
To: shaggy, akpm
Cc: willy, shivankg, david, wangkefeng.wang, jane.chu, ziy, donettom,
apopple, jfs-discussion, linux-kernel, linux-mm,
syzbot+8bb6fd945af4e0ad9299
Implement folio_expected_ref_count() to calculate expected folio
reference counts from:
- Page/swap cache (1 per page)
- Private data (1)
- Page table mappings (1 per map)
While originally needed for page migration operations, this improved
implementation standardizes reference counting by consolidating all
refcount contributors into a single, reusable function that can benefit
any subsystem needing to detect unexpected references to folios.
The folio_expected_ref_count() returns the sum of these external
references without including any reference the caller itself might hold.
Callers comparing against the actual folio_ref_count() must account for
their own references separately.
Suggested-by: Matthew Wilcox <willy@infradead.org>
Co-developed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Shivank Garg <shivankg@amd.com>
---
include/linux/mm.h | 55 ++++++++++++++++++++++++++++++++++++++++++++++
mm/migrate.c | 22 ++++---------------
2 files changed, 59 insertions(+), 18 deletions(-)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 68d3dd14b323..1db540bb9381 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -2115,6 +2115,61 @@ static inline bool folio_maybe_mapped_shared(struct folio *folio)
return folio_test_large_maybe_mapped_shared(folio);
}
+/**
+ * folio_expected_ref_count - calculate the expected folio refcount
+ * @folio: the folio
+ *
+ * Calculate the expected folio refcount, taking references from the pagecache,
+ * swapcache, PG_private and page table mappings into account. Useful in
+ * combination with folio_ref_count() to detect unexpected references (e.g.,
+ * GUP or other temporary references).
+ *
+ * Does currently not consider references from the LRU cache. If the folio
+ * was isolated from the LRU (which is the case during migration or split),
+ * the LRU cache does not apply.
+ *
+ * Calling this function on an unmapped folio -- !folio_mapped() -- that is
+ * locked will return a stable result.
+ *
+ * Calling this function on a mapped folio will not result in a stable result,
+ * because nothing stops additional page table mappings from coming (e.g.,
+ * fork()) or going (e.g., munmap()).
+ *
+ * Calling this function without the folio lock will also not result in a
+ * stable result: for example, the folio might get dropped from the swapcache
+ * concurrently.
+ *
+ * However, even when called without the folio lock or on a mapped folio,
+ * this function can be used to detect unexpected references early (for example,
+ * if it makes sense to even lock the folio and unmap it).
+ *
+ * The caller must add any reference (e.g., from folio_try_get()) it might be
+ * holding itself to the result.
+ *
+ * Returns the expected folio refcount.
+ */
+static inline int folio_expected_ref_count(const struct folio *folio)
+{
+ const int order = folio_order(folio);
+ int ref_count = 0;
+
+ if (WARN_ON_ONCE(folio_test_slab(folio)))
+ return 0;
+
+ if (folio_test_anon(folio)) {
+ /* One reference per page from the swapcache. */
+ ref_count += folio_test_swapcache(folio) << order;
+ } else if (!((unsigned long)folio->mapping & PAGE_MAPPING_FLAGS)) {
+ /* One reference per page from the pagecache. */
+ ref_count += !!folio->mapping << order;
+ /* One reference from PG_private. */
+ ref_count += folio_test_private(folio);
+ }
+
+ /* One reference per page table mapping. */
+ return ref_count + folio_mapcount(folio);
+}
+
#ifndef HAVE_ARCH_MAKE_FOLIO_ACCESSIBLE
static inline int arch_make_folio_accessible(struct folio *folio)
{
diff --git a/mm/migrate.c b/mm/migrate.c
index c80591514e66..67f2bf1eb51e 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -445,20 +445,6 @@ void pmd_migration_entry_wait(struct mm_struct *mm, pmd_t *pmd)
}
#endif
-static int folio_expected_refs(struct address_space *mapping,
- struct folio *folio)
-{
- int refs = 1;
- if (!mapping)
- return refs;
-
- refs += folio_nr_pages(folio);
- if (folio_test_private(folio))
- refs++;
-
- return refs;
-}
-
/*
* Replace the folio in the mapping.
*
@@ -601,7 +587,7 @@ static int __folio_migrate_mapping(struct address_space *mapping,
int folio_migrate_mapping(struct address_space *mapping,
struct folio *newfolio, struct folio *folio, int extra_count)
{
- int expected_count = folio_expected_refs(mapping, folio) + extra_count;
+ int expected_count = folio_expected_ref_count(folio) + extra_count + 1;
if (folio_ref_count(folio) != expected_count)
return -EAGAIN;
@@ -618,7 +604,7 @@ int migrate_huge_page_move_mapping(struct address_space *mapping,
struct folio *dst, struct folio *src)
{
XA_STATE(xas, &mapping->i_pages, folio_index(src));
- int rc, expected_count = folio_expected_refs(mapping, src);
+ int rc, expected_count = folio_expected_ref_count(src) + 1;
if (folio_ref_count(src) != expected_count)
return -EAGAIN;
@@ -749,7 +735,7 @@ static int __migrate_folio(struct address_space *mapping, struct folio *dst,
struct folio *src, void *src_private,
enum migrate_mode mode)
{
- int rc, expected_count = folio_expected_refs(mapping, src);
+ int rc, expected_count = folio_expected_ref_count(src) + 1;
/* Check whether src does not have extra refs before we do more work */
if (folio_ref_count(src) != expected_count)
@@ -837,7 +823,7 @@ static int __buffer_migrate_folio(struct address_space *mapping,
return migrate_folio(mapping, dst, src, mode);
/* Check whether page does not have extra refs before we do more work */
- expected_count = folio_expected_refs(mapping, src);
+ expected_count = folio_expected_ref_count(src) + 1;
if (folio_ref_count(src) != expected_count)
return -EAGAIN;
--
2.34.1
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH V5 2/2] jfs: implement migrate_folio for jfs_metapage_aops
2025-04-30 10:01 [PATCH V5 0/2] JFS: Implement migrate_folio for jfs_metapage_aops Shivank Garg
2025-04-30 10:01 ` [PATCH V5 1/2] mm: Add folio_expected_ref_count() for reference count calculation Shivank Garg
@ 2025-04-30 10:01 ` Shivank Garg
2025-04-30 10:38 ` [syzbot] [mm?] WARNING in move_to_new_folio syzbot
2025-04-30 21:21 ` [PATCH V5 0/2] JFS: Implement migrate_folio for jfs_metapage_aops Andrew Morton
3 siblings, 0 replies; 6+ messages in thread
From: Shivank Garg @ 2025-04-30 10:01 UTC (permalink / raw)
To: shaggy, akpm
Cc: willy, shivankg, david, wangkefeng.wang, jane.chu, ziy, donettom,
apopple, jfs-discussion, linux-kernel, linux-mm,
syzbot+8bb6fd945af4e0ad9299
Add the missing migrate_folio operation to jfs_metapage_aops to fix
warnings during memory compaction. These warnings were introduced by
commit 7ee3647243e5 ("migrate: Remove call to ->writepage") which
added explicit warnings when filesystems don't implement migrate_folio.
System reports following warnings:
jfs_metapage_aops does not implement migrate_folio
WARNING: CPU: 0 PID: 6870 at mm/migrate.c:955 fallback_migrate_folio mm/migrate.c:953 [inline]
WARNING: CPU: 0 PID: 6870 at mm/migrate.c:955 move_to_new_folio+0x70e/0x840 mm/migrate.c:1007
Implement metapage_migrate_folio() which handles both single and multiple
metapages per page configurations.
Fixes: 35474d52c605 ("jfs: Convert metapage_writepage to metapage_write_folio")
Reported-by: syzbot+8bb6fd945af4e0ad9299@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67faff52.050a0220.379d84.001b.GAE@google.com
Tested-by: syzbot+8bb6fd945af4e0ad9299@syzkaller.appspotmail.com
Signed-off-by: Shivank Garg <shivankg@amd.com>
---
The commit
e7021e2fe0b4 ("x86/efi: Make efi_enter/leave_mm() use the use_/unuse_temporary_mm() machinery")
is introducing some regression on linux-next, blocking me from testing JFS issue.
https://lore.kernel.org/all/SJ1PR11MB6129E62E3B372932C6B7477FB9BD2@SJ1PR11MB6129.namprd11.prod.outlook.com/
After reverting the above series, the syzcaller did not report any issue with my patch.
Syzbot Test link: https://lore.kernel.org/all/6811f0a8.050a0220.39e3a1.0d08.GAE@google.com/
---
fs/jfs/jfs_metapage.c | 94 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 94 insertions(+)
diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index df575a873ec6..f863ba521533 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -15,6 +15,7 @@
#include <linux/mempool.h>
#include <linux/seq_file.h>
#include <linux/writeback.h>
+#include <linux/migrate.h>
#include "jfs_incore.h"
#include "jfs_superblock.h"
#include "jfs_filsys.h"
@@ -151,6 +152,54 @@ static inline void dec_io(struct folio *folio, blk_status_t status,
handler(folio, anchor->status);
}
+static int __metapage_migrate_folio(struct address_space *mapping, struct folio *dst,
+ struct folio *src, enum migrate_mode mode)
+{
+ struct meta_anchor *src_anchor = src->private;
+ struct metapage *mps[MPS_PER_PAGE] = {0};
+ struct metapage *mp;
+ int i, rc;
+
+ for (i = 0; i < MPS_PER_PAGE; i++) {
+ mp = src_anchor->mp[i];
+ if (mp && metapage_locked(mp))
+ return -EAGAIN;
+ }
+
+ rc = filemap_migrate_folio(mapping, dst, src, mode);
+ if (rc != MIGRATEPAGE_SUCCESS)
+ return rc;
+
+ for (i = 0; i < MPS_PER_PAGE; i++) {
+ mp = src_anchor->mp[i];
+ if (!mp)
+ continue;
+ if (unlikely(insert_metapage(dst, mp))) {
+ /* If error, roll-back previosly inserted pages */
+ for (int j = 0 ; j < i; j++) {
+ if (mps[j])
+ remove_metapage(dst, mps[j]);
+ }
+ return -EAGAIN;
+ }
+ mps[i] = mp;
+ }
+
+ /* Update the metapage and remove it from src */
+ for (i = 0; i < MPS_PER_PAGE; i++) {
+ mp = mps[i];
+ if (mp) {
+ int page_offset = mp->data - folio_address(src);
+
+ mp->data = folio_address(dst) + page_offset;
+ mp->folio = dst;
+ remove_metapage(src, mp);
+ }
+ }
+
+ return MIGRATEPAGE_SUCCESS;
+}
+
#else
static inline struct metapage *folio_to_mp(struct folio *folio, int offset)
{
@@ -175,6 +224,32 @@ static inline void remove_metapage(struct folio *folio, struct metapage *mp)
#define inc_io(folio) do {} while(0)
#define dec_io(folio, status, handler) handler(folio, status)
+static int __metapage_migrate_folio(struct address_space *mapping, struct folio *dst,
+ struct folio *src, enum migrate_mode mode)
+{
+ struct metapage *mp;
+ int page_offset;
+ int rc;
+
+ mp = folio_to_mp(src, 0);
+ if (mp && metapage_locked(mp))
+ return -EAGAIN;
+
+ rc = filemap_migrate_folio(mapping, dst, src, mode);
+ if (rc != MIGRATEPAGE_SUCCESS)
+ return rc;
+
+ if (unlikely(insert_metapage(dst, mp)))
+ return -EAGAIN;
+
+ page_offset = mp->data - folio_address(src);
+ mp->data = folio_address(dst) + page_offset;
+ mp->folio = dst;
+ remove_metapage(src, mp);
+
+ return MIGRATEPAGE_SUCCESS;
+}
+
#endif
static inline struct metapage *alloc_metapage(gfp_t gfp_mask)
@@ -554,6 +629,24 @@ static bool metapage_release_folio(struct folio *folio, gfp_t gfp_mask)
return ret;
}
+/**
+ * metapage_migrate_folio - Migration function for JFS metapages
+ */
+static int metapage_migrate_folio(struct address_space *mapping, struct folio *dst,
+ struct folio *src, enum migrate_mode mode)
+{
+ int expected_count;
+
+ if (!src->private)
+ return filemap_migrate_folio(mapping, dst, src, mode);
+
+ /* Check whether page does not have extra refs before we do more work */
+ expected_count = folio_expected_ref_count(src) + 1;
+ if (folio_ref_count(src) != expected_count)
+ return -EAGAIN;
+ return __metapage_migrate_folio(mapping, dst, src, mode);
+}
+
static void metapage_invalidate_folio(struct folio *folio, size_t offset,
size_t length)
{
@@ -570,6 +663,7 @@ const struct address_space_operations jfs_metapage_aops = {
.release_folio = metapage_release_folio,
.invalidate_folio = metapage_invalidate_folio,
.dirty_folio = filemap_dirty_folio,
+ .migrate_folio = metapage_migrate_folio,
};
struct metapage *__get_metapage(struct inode *inode, unsigned long lblock,
--
2.34.1
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [syzbot] [mm?] WARNING in move_to_new_folio
2025-04-30 10:01 [PATCH V5 0/2] JFS: Implement migrate_folio for jfs_metapage_aops Shivank Garg
2025-04-30 10:01 ` [PATCH V5 1/2] mm: Add folio_expected_ref_count() for reference count calculation Shivank Garg
2025-04-30 10:01 ` [PATCH V5 2/2] jfs: implement migrate_folio for jfs_metapage_aops Shivank Garg
@ 2025-04-30 10:38 ` syzbot
2025-04-30 21:21 ` [PATCH V5 0/2] JFS: Implement migrate_folio for jfs_metapage_aops Andrew Morton
3 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2025-04-30 10:38 UTC (permalink / raw)
To: akpm, apopple, david, donettom, jane.chu, jfs-discussion,
linux-kernel, linux-mm, shaggy, shivankg, syzkaller-bugs,
wangkefeng.wang, willy, ziy
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+8bb6fd945af4e0ad9299@syzkaller.appspotmail.com
Tested-by: syzbot+8bb6fd945af4e0ad9299@syzkaller.appspotmail.com
Tested on:
commit: 69a58d52 Revert "x86/mm: Add 'mm' argument to unuse_te..
git tree: https://github.com/shivankgarg98/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=137a68d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f002bbe3fe2ccafa
dashboard link: https://syzkaller.appspot.com/bug?extid=8bb6fd945af4e0ad9299
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH V5 0/2] JFS: Implement migrate_folio for jfs_metapage_aops
2025-04-30 10:01 [PATCH V5 0/2] JFS: Implement migrate_folio for jfs_metapage_aops Shivank Garg
` (2 preceding siblings ...)
2025-04-30 10:38 ` [syzbot] [mm?] WARNING in move_to_new_folio syzbot
@ 2025-04-30 21:21 ` Andrew Morton
2025-05-01 12:37 ` Matthew Wilcox
3 siblings, 1 reply; 6+ messages in thread
From: Andrew Morton @ 2025-04-30 21:21 UTC (permalink / raw)
To: Shivank Garg
Cc: shaggy, willy, david, wangkefeng.wang, jane.chu, ziy, donettom,
apopple, jfs-discussion, linux-kernel, linux-mm,
syzbot+8bb6fd945af4e0ad9299
On Wed, 30 Apr 2025 10:01:49 +0000 Shivank Garg <shivankg@amd.com> wrote:
> This patch addresses a warning that occurs during memory compaction due
> to JFS's missing migrate_folio operation. The warning was introduced by
> commit 7ee3647243e5 ("migrate: Remove call to ->writepage") which added
> explicit warnings when filesystem don't implement migrate_folio.
>
> The syzbot reported following [1]:
> jfs_metapage_aops does not implement migrate_folio
> WARNING: CPU: 1 PID: 5861 at mm/migrate.c:955 fallback_migrate_folio mm/migrate.c:953 [inline]
> WARNING: CPU: 1 PID: 5861 at mm/migrate.c:955 move_to_new_folio+0x70e/0x840 mm/migrate.c:1007
> Modules linked in:
> CPU: 1 UID: 0 PID: 5861 Comm: syz-executor280 Not tainted 6.15.0-rc1-next-20250411-syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
> RIP: 0010:fallback_migrate_folio mm/migrate.c:953 [inline]
> RIP: 0010:move_to_new_folio+0x70e/0x840 mm/migrate.c:1007
>
> To fix this issue, this series implement metapage_migrate_folio() for JFS
> which handles both single and multiple metapages per page configurations.
Thanks, I'll add these to mm.git for some testing while discussion
proceeds.
Do we think these patches should be backported into -stable kernels?
Or maybe we should simply remove the warning from -stable kernels then
re-add it when we're confident that all in-tree filesystems are good?
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH V5 0/2] JFS: Implement migrate_folio for jfs_metapage_aops
2025-04-30 21:21 ` [PATCH V5 0/2] JFS: Implement migrate_folio for jfs_metapage_aops Andrew Morton
@ 2025-05-01 12:37 ` Matthew Wilcox
0 siblings, 0 replies; 6+ messages in thread
From: Matthew Wilcox @ 2025-05-01 12:37 UTC (permalink / raw)
To: Andrew Morton
Cc: Shivank Garg, shaggy, david, wangkefeng.wang, jane.chu, ziy,
donettom, apopple, jfs-discussion, linux-kernel, linux-mm,
syzbot+8bb6fd945af4e0ad9299
On Wed, Apr 30, 2025 at 02:21:35PM -0700, Andrew Morton wrote:
> On Wed, 30 Apr 2025 10:01:49 +0000 Shivank Garg <shivankg@amd.com> wrote:
> > This patch addresses a warning that occurs during memory compaction due
> > to JFS's missing migrate_folio operation. The warning was introduced by
> > commit 7ee3647243e5 ("migrate: Remove call to ->writepage") which added
> > explicit warnings when filesystem don't implement migrate_folio.
>
> Do we think these patches should be backported into -stable kernels?
>
> Or maybe we should simply remove the warning from -stable kernels then
> re-add it when we're confident that all in-tree filesystems are good?
7ee3647243e5 is not yet in Linus' tree, let alone in -stable.
^ permalink raw reply [flat|nested] 6+ messages in thread