linux-kernel - Re: [PATCH v3 08/12] nfs: drop usage of folio_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMgjq7A+W9g8Bng22+iROgdq_Khz=v2Mj70VNAH2Q9ckK50AKQ@mail.gmail.com>
Date: Tue, 30 Apr 2024 03:42:54 +0800
From: Kairui Song <ryncsn@...il.com>
To: Matthew Wilcox <willy@...radead.org>
Cc: linux-mm@...ck.org, Andrew Morton <akpm@...ux-foundation.org>, 
	"Huang, Ying" <ying.huang@...el.com>, Chris Li <chrisl@...nel.org>, 
	Barry Song <v-songbaohua@...o.com>, Ryan Roberts <ryan.roberts@....com>, Neil Brown <neilb@...e.de>, 
	Minchan Kim <minchan@...nel.org>, Hugh Dickins <hughd@...gle.com>, 
	David Hildenbrand <david@...hat.com>, Yosry Ahmed <yosryahmed@...gle.com>, linux-fsdevel@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3 08/12] nfs: drop usage of folio_file_pos

On Tue, Apr 30, 2024 at 3:21 AM Matthew Wilcox <willy@...radead.org> wrote:
>
> On Tue, Apr 30, 2024 at 03:11:34AM +0800, Kairui Song wrote:
> > +++ b/fs/nfs/file.c
> > @@ -588,7 +588,7 @@ static vm_fault_t nfs_vm_page_mkwrite(struct vm_fault *vmf)
> >
> >       dfprintk(PAGECACHE, "NFS: vm_page_mkwrite(%pD2(%lu), offset %lld)\n",
> >                filp, filp->f_mapping->host->i_ino,
> > -              (long long)folio_file_pos(folio));
> > +              (long long)folio_pos(folio));
>
> Yes, we can't call page_mkwrite() on a swapcache page.
>
> > +++ b/fs/nfs/nfstrace.h
> > @@ -960,7 +960,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event,
> >                       __entry->fileid = nfsi->fileid;
> >                       __entry->fhandle = nfs_fhandle_hash(&nfsi->fh);
> >                       __entry->version = inode_peek_iversion_raw(inode);
> > -                     __entry->offset = folio_file_pos(folio);
> > +                     __entry->offset = folio_pos(folio);
> >                       __entry->count = nfs_folio_length(folio);
> >               ),
> >
> > @@ -1008,7 +1008,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done,
> >                       __entry->fileid = nfsi->fileid;
> >                       __entry->fhandle = nfs_fhandle_hash(&nfsi->fh);
> >                       __entry->version = inode_peek_iversion_raw(inode);
> > -                     __entry->offset = folio_file_pos(folio);
> > +                     __entry->offset = folio_pos(folio);
>
> These two I don't know about.

I can add a more detailed call chain for this in the commit message to
make it look more convincing.

> > +++ b/fs/nfs/write.c
> > @@ -281,7 +281,7 @@ static void nfs_grow_file(struct folio *folio, unsigned int offset,
> >       end_index = ((i_size - 1) >> folio_shift(folio)) << folio_order(folio);
> >       if (i_size > 0 && folio_index(folio) < end_index)
> >               goto out;
> > -     end = folio_file_pos(folio) + (loff_t)offset + (loff_t)count;
> > +     end = folio_pos(folio) + (loff_t)offset + (loff_t)count;
>
> This one concerns me.  Are we sure we can't call nfs_grow_file()
> for a swapfile?

Right, I did a audit of the code, all callers of nfs_grow_file are listed below:
write_end -> nfs_write_end -> nfs_update_folio -> nfs_writepage_setup
-> nfs_grow_file
page_mkwrite -> nfs_vm_page_mkwrite -> nfs_update_folio ->
nfs_writepage_setup -> nfs_grow_file

>
> > @@ -2073,7 +2073,7 @@ int nfs_wb_folio_cancel(struct inode *inode, struct folio *folio)
> >   */
> >  int nfs_wb_folio(struct inode *inode, struct folio *folio)
> >  {
> > -     loff_t range_start = folio_file_pos(folio);
> > +     loff_t range_start = folio_pos(folio);
> >       loff_t range_end = range_start + (loff_t)folio_size(folio) - 1;
>
> Likewise here.  Are we absolutely certain that swap I/O can't call this
> function?

Similar above:
release_folio -> nfs_release_folio -> nfs_wb_folio
launder_folio -> nfs_launder_folio -> nfs_wb_folio
write_begin -> nfs_write_begin -> nfs_read_folio -> nfs_wb_folio
read_folio -> nfs_read_folio -> nfs_wb_folio
nfs_update_folio (listed above) -> nfs_writepage_setup ->
nfs_setup_write_request -> nfs_try_to_update_request -> nfs_wb_folio--
write_begin -> nfs_write_begin -> nfs_flush_incompatible -> nfs_wb_folio
page_mkwrite -> nfs_vm_page_mkwrite -> nfs_flush_incompatible -> nfs_wb_folio

And nothing from the swap mapping side can call into fs, except
swap_rw, none of the helpers are called by that.