Re: [PATCH 02/13] mm: cachestat: count each page only once

[Usama Arif <usama.arif@linux.dev>]

On 11/11/2026 18:13, Lorenzo Stoakes (ARM) wrote:
> From: Chris Mason <mason@kernel.org>
> 
> It turns out that filemap_cachestat() can unwittingly return incorrect
> page counts, if large folios are present.
> 
> This can occur due to underflow - nr_cache is nearly 2^64 on a 64-bit
> kernel if the input range starts more than 64 pages into a folio that is
> split during the call.
> 
> It can also occur due to pages after a large folio being skipped if the
> range starts in its second or later XArray slot and the call reschedules at
> that folio.
> 
> Finally it can be caused by pages being counted twice due to folios in the
> range being split or collapsed during the call.
> 
> filemap_cachestat() walks the page cache under the RCU read lock only,
> and for each entry it counts the pages that lie in the range. It does
> not track how far it has counted, so the counts are only right if the
> walk returns each index once.
> 
> But a large folio can be split during the walk, or small folios can be
> collapsed into a large one, and the next entries then cover indices that
> were already counted.
> 
> Resolve the issue by tracking the current index as one past the last index
> in the folio, and explicitly using xas_set() to set the current position in
> the XArray.
> 
> Additionally, add a check for folio_last_index reaching or exceeding
> last_index and break out of the loop if so.
> 
> Fixes: cf264e1329fb ("cachestat: implement cachestat syscall")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Chris Mason <mason@kernel.org>
> [ ljs: updated to use curr_index, fixed comments, updated commit message ]
> Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
> ---


First time I have looked at cachestat, but it makes sense. Tracking curr_index
makes cachestat skip already counted entries, preventing duplicate counts 
during folio splits or collapses.

Acked-by: Usama Arif <usama.arif@linux.dev>


>  mm/filemap.c | 16 +++++++++++++---
>  1 file changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/mm/filemap.c b/mm/filemap.c
> index b04be64a5069..7c05e4fad081 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -4638,6 +4638,7 @@ static void filemap_cachestat(struct address_space *mapping,
>  {
>  	XA_STATE(xas, &mapping->i_pages, first_index);
>  	struct folio *folio;
> +	pgoff_t curr_index = first_index;
>  
>  	/* Flush stats (and potentially sleep) outside the RCU read section. */
>  	mem_cgroup_flush_stats_ratelimited(NULL);
> @@ -4667,13 +4668,19 @@ static void filemap_cachestat(struct address_space *mapping,
>  		folio_first_index = round_down(xas.xa_index, 1 << order);
>  		folio_last_index = folio_first_index + nr_pages - 1;
>  
> +		/* Skip already counted entries, e.g. after a split/collapse. */
> +		if (folio_last_index < curr_index)
> +			goto resched;
> +
>  		/* Folios might straddle the range boundaries, only count covered pages */
> -		if (folio_first_index < first_index)
> -			nr_pages -= first_index - folio_first_index;
> +		if (folio_first_index < curr_index)
> +			nr_pages -= curr_index - folio_first_index;
>  
>  		if (folio_last_index > last_index)
>  			nr_pages -= folio_last_index - last_index;
>  
> +		curr_index = folio_last_index + 1;
> +
>  		if (xa_is_value(folio)) {
>  			/* page is evicted */
>  			void *shadow = (void *)folio;
> @@ -4721,8 +4728,11 @@ static void filemap_cachestat(struct address_space *mapping,
>  			cs->nr_writeback += nr_pages;
>  
>  resched:
> +		if (folio_last_index >= last_index)
> +			break;
> +
>  		if (need_resched()) {
> -			xas_pause(&xas);
> +			xas_set(&xas, curr_index);
>  			cond_resched_rcu();
>  		}
>  	}
>