| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <3c332dea-ea60-4939-9843-ac7d3068c7c8@kernel.org>
Date: Thu, 20 Nov 2025 10:32:36 +0100
From: "David Hildenbrand (Red Hat)" <david@...nel.org>
To: Balbir Singh <balbirs@...dia.com>, linux-kernel@...r.kernel.org,
linux-mm@...ck.org, dri-devel@...ts.freedesktop.org
Cc: Andrew Morton <akpm@...ux-foundation.org>, Zi Yan <ziy@...dia.com>,
Joshua Hahn <joshua.hahnjy@...il.com>, Rakie Kim <rakie.kim@...com>,
Byungchul Park <byungchul@...com>, Gregory Price <gourry@...rry.net>,
Ying Huang <ying.huang@...ux.alibaba.com>,
Alistair Popple <apopple@...dia.com>, Oscar Salvador <osalvador@...e.de>,
Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
Baolin Wang <baolin.wang@...ux.alibaba.com>,
"Liam R. Howlett" <Liam.Howlett@...cle.com>, Nico Pache <npache@...hat.com>,
Ryan Roberts <ryan.roberts@....com>, Dev Jain <dev.jain@....com>,
Barry Song <baohua@...nel.org>, Lyude Paul <lyude@...hat.com>,
Danilo Krummrich <dakr@...nel.org>, David Airlie <airlied@...il.com>,
Simona Vetter <simona@...ll.ch>, Ralph Campbell <rcampbell@...dia.com>,
Mika Penttilä <mpenttil@...hat.com>,
Matthew Brost <matthew.brost@...el.com>,
Francois Dugast <francois.dugast@...el.com>
Subject: Re: [PATCH] fixup: mm/huge_memory.c: introduce folio_split_unmapped
On 11/20/25 10:25, Balbir Singh wrote:
> On 11/20/25 20:09, David Hildenbrand (Red Hat) wrote:
>> On 11/20/25 04:07, Balbir Singh wrote:
>>> Code refactoring of __folio_split() via helper
>>> __folio_freeze_and_split_unmapped() caused a regression with clang-20
>>> with CONFIG_SHMEM=n, the compiler was not able to optimize away the
>>> call to shmem_uncharge() due to changes in nr_shmem_dropped.
>>> Fix this by checking for shmem_mapping() prior to calling
>>> shmem_uncharge(), shmem_mapping() returns false when CONFIG_SHMEM=n.
>>>
>>> smatch also complained about parameter end being used without
>>> initialization, which is a false positive, but keep the tool happy
>>> by sending in initialized parameters. end is initialized to 0.
>>>
>>> Add detailed documentation comments for folio_split_unmapped()
>>>
>>> Cc: Andrew Morton <akpm@...ux-foundation.org>
>>> Cc: David Hildenbrand <david@...hat.com>
>>> Cc: Zi Yan <ziy@...dia.com>
>>> Cc: Joshua Hahn <joshua.hahnjy@...il.com>
>>> Cc: Rakie Kim <rakie.kim@...com>
>>> Cc: Byungchul Park <byungchul@...com>
>>> Cc: Gregory Price <gourry@...rry.net>
>>> Cc: Ying Huang <ying.huang@...ux.alibaba.com>
>>> Cc: Alistair Popple <apopple@...dia.com>
>>> Cc: Oscar Salvador <osalvador@...e.de>
>>> Cc: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
>>> Cc: Baolin Wang <baolin.wang@...ux.alibaba.com>
>>> Cc: "Liam R. Howlett" <Liam.Howlett@...cle.com>
>>> Cc: Nico Pache <npache@...hat.com>
>>> Cc: Ryan Roberts <ryan.roberts@....com>
>>> Cc: Dev Jain <dev.jain@....com>
>>> Cc: Barry Song <baohua@...nel.org>
>>> Cc: Lyude Paul <lyude@...hat.com>
>>> Cc: Danilo Krummrich <dakr@...nel.org>
>>> Cc: David Airlie <airlied@...il.com>
>>> Cc: Simona Vetter <simona@...ll.ch>
>>> Cc: Ralph Campbell <rcampbell@...dia.com>
>>> Cc: Mika Penttilä <mpenttil@...hat.com>
>>> Cc: Matthew Brost <matthew.brost@...el.com>
>>> Cc: Francois Dugast <francois.dugast@...el.com>
>>>
>>> Signed-off-by: Balbir Singh <balbirs@...dia.com>
>>> ---
>>> mm/huge_memory.c | 32 ++++++++++++++++++++++----------
>>> 1 file changed, 22 insertions(+), 10 deletions(-)
>>>
>>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
>>> index 78a31a476ad3..c4267a0f74df 100644
>>> --- a/mm/huge_memory.c
>>> +++ b/mm/huge_memory.c
>>> @@ -3751,6 +3751,7 @@ static int __folio_freeze_and_split_unmapped(struct folio *folio, unsigned int n
>>> int ret = 0;
>>> struct deferred_split *ds_queue;
>>> + VM_WARN_ON_ONCE(!mapping && end != 0);
>>
>> You could drop the "!= 0"
>
> Ack
>
> VM_WARN_ONE(!mapping && end);
>
>>
>>> /* Prevent deferred_split_scan() touching ->_refcount */
>>> ds_queue = folio_split_queue_lock(folio);
>>> if (folio_ref_freeze(folio, 1 + extra_pins)) {
>>> @@ -3919,7 +3920,7 @@ static int __folio_split(struct folio *folio, unsigned int new_order,
>>> int nr_shmem_dropped = 0;
>>> int remap_flags = 0;
>>> int extra_pins, ret;
>>> - pgoff_t end;
>>> + pgoff_t end = 0;
>>> bool is_hzp;
>>> VM_WARN_ON_ONCE_FOLIO(!folio_test_locked(folio), folio);
>>> @@ -4049,7 +4050,7 @@ static int __folio_split(struct folio *folio, unsigned int new_order,
>>> local_irq_enable();
>>> - if (nr_shmem_dropped)
>>> + if (mapping && shmem_mapping(mapping) && nr_shmem_dropped)
>>> shmem_uncharge(mapping->host, nr_shmem_dropped);
>>
>> That looks questionable. We shouldn't add runtime check to handle buildtime things.
>>
>> Likely what you want is instead
>>
>> if (IS_ENABLED(CONFIG_SHMEM) && nr_shmem_dropped)
>> shmem_uncharge()
>>
>
> shmem_mapping() returns false for CONFIG_SHMEM=n and shmem_mapping() checks that the mapping
> is indeed for shmem ops before uncharging. Happy to change it if you like,
> your version is more readable
Good point, but the questionable thing is that it looks like nr_shmem_dropped
could be set for non-shmem mappings, when it's really just a compiler thing.
What about handling it through a proper stub so we can keep this calling code simple?
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index 5b368f9549d67..e38cb01031200 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -136,11 +136,15 @@ static inline bool shmem_hpage_pmd_enabled(void)
#ifdef CONFIG_SHMEM
extern unsigned long shmem_swap_usage(struct vm_area_struct *vma);
+extern void shmem_uncharge(struct inode *inode, long pages);
#else
static inline unsigned long shmem_swap_usage(struct vm_area_struct *vma)
{
return 0;
}
+static inline void shmem_uncharge(struct inode *inode, long pages)
+{
+}
#endif
extern unsigned long shmem_partial_swap_usage(struct address_space *mapping,
pgoff_t start, pgoff_t end);
@@ -194,7 +198,6 @@ static inline pgoff_t shmem_fallocend(struct inode *inode, pgoff_t eof)
}
extern bool shmem_charge(struct inode *inode, long pages);
-extern void shmem_uncharge(struct inode *inode, long pages);
#ifdef CONFIG_USERFAULTFD
#ifdef CONFIG_SHMEM
--
Cheers
David
Powered by blists - more mailing lists