linux-kernel - Re: [PATCH] iomap: move prefaulting out of hot write path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251009150125.GD6188@frogsfrogsfrogs>
Date: Thu, 9 Oct 2025 08:01:25 -0700
From: "Darrick J. Wong" <djwong@...nel.org>
To: alexjlzheng@...il.com, dave.hansen@...ux.intel.com
Cc: brauner@...nel.org, linux-xfs@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	dave.hansen@...ux.intel.com,
	Jinliang Zheng <alexjlzheng@...cent.com>
Subject: Re: [PATCH] iomap: move prefaulting out of hot write path

On Thu, Oct 09, 2025 at 05:08:51PM +0800, alexjlzheng@...il.com wrote:
> From: Jinliang Zheng <alexjlzheng@...cent.com>
> 
> Prefaulting the write source buffer incurs an extra userspace access
> in the common fast path. Make iomap_write_iter() consistent with
> generic_perform_write(): only touch userspace an extra time when
> copy_folio_from_iter_atomic() has failed to make progress.
> 
> This patch is inspired by commit 665575cff098 ("filemap: move
> prefaulting out of hot write path").

Seems fine to me, but I wonder if dhansen has any thoughts about this
patch ... which exactly mirrors one he sent eight months ago?

--D

> Signed-off-by: Jinliang Zheng <alexjlzheng@...cent.com>
> ---
>  fs/iomap/buffered-io.c | 31 ++++++++++++++++---------------
>  1 file changed, 16 insertions(+), 15 deletions(-)
> 
> diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
> index 8b847a1e27f1..6e6573fce78a 100644
> --- a/fs/iomap/buffered-io.c
> +++ b/fs/iomap/buffered-io.c
> @@ -972,21 +972,6 @@ static int iomap_write_iter(struct iomap_iter *iter, struct iov_iter *i,
>  		if (bytes > iomap_length(iter))
>  			bytes = iomap_length(iter);
>  
> -		/*
> -		 * Bring in the user page that we'll copy from _first_.
> -		 * Otherwise there's a nasty deadlock on copying from the
> -		 * same page as we're writing to, without it being marked
> -		 * up-to-date.
> -		 *
> -		 * For async buffered writes the assumption is that the user
> -		 * page has already been faulted in. This can be optimized by
> -		 * faulting the user page.
> -		 */
> -		if (unlikely(fault_in_iov_iter_readable(i, bytes) == bytes)) {
> -			status = -EFAULT;
> -			break;
> -		}
> -
>  		status = iomap_write_begin(iter, write_ops, &folio, &offset,
>  				&bytes);
>  		if (unlikely(status)) {
> @@ -1001,6 +986,12 @@ static int iomap_write_iter(struct iomap_iter *iter, struct iov_iter *i,
>  		if (mapping_writably_mapped(mapping))
>  			flush_dcache_folio(folio);
>  
> +		/*
> +		 * Faults here on mmap()s can recurse into arbitrary
> +		 * filesystem code. Lots of locks are held that can
> +		 * deadlock. Use an atomic copy to avoid deadlocking
> +		 * in page fault handling.
> +		 */
>  		copied = copy_folio_from_iter_atomic(folio, offset, bytes, i);
>  		written = iomap_write_end(iter, bytes, copied, folio) ?
>  			  copied : 0;
> @@ -1039,6 +1030,16 @@ static int iomap_write_iter(struct iomap_iter *iter, struct iov_iter *i,
>  				bytes = copied;
>  				goto retry;
>  			}
> +
> +			/*
> +			 * 'folio' is now unlocked and faults on it can be
> +			 * handled. Ensure forward progress by trying to
> +			 * fault it in now.
> +			 */
> +			if (fault_in_iov_iter_readable(i, bytes) == bytes) {
> +				status = -EFAULT;
> +				break;
> +			}
>  		} else {
>  			total_written += written;
>  			iomap_iter_advance(iter, &written);
> -- 
> 2.49.0
> 
>