Re: [PATCH] shmem: Serialize fallocate progress with writeout

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] mm: shmem: unsigned underflow of unmap_end in
  shmem_fallocate() [1]
--

commit 9946039967ae29ddb921f16d447ade65e0f1335b
Author: Zhu Jun <zhujun2@cmss.chinamobile.com>

shmem: Serialize fallocate progress with writeout

This commit takes inode->i_lock in shmem_fallocate() when reading
shmem_falloc.nr_unswapped and updating shmem_falloc progress to synchronize
with shmem_writeout().

> diff --git a/mm/shmem.c b/mm/shmem.c
> index 4686875a3adde..219ac18aef915 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -3981,6 +3981,11 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
>  
>  	for (index = start; index < end; ) {
>  		struct folio *folio;
> +		bool unswapped;
> +
> +		spin_lock(&inode->i_lock);
> +		unswapped = shmem_falloc.nr_unswapped > shmem_falloc.nr_falloced;
> +		spin_unlock(&inode->i_lock);

[Severity: Medium]
This problem wasn't introduced by this patch, but can unmap_end underflow
when cast to u64 earlier in shmem_fallocate() [1]?

mm/shmem.c:shmem_fallocate() {
	...
	if (mode & FALLOC_FL_PUNCH_HOLE) {
		struct address_space *mapping = file->f_mapping;
		loff_t unmap_start = round_up(offset, PAGE_SIZE);
		loff_t unmap_end = round_down(offset + len, PAGE_SIZE) - 1;
		...
		if ((u64)unmap_end > (u64)unmap_start)
			unmap_mapping_range(mapping, unmap_start,
					    1 + unmap_end - unmap_start, 0);
	...
}

When punching a hole with offset + len < PAGE_SIZE, round_down(offset +
len, PAGE_SIZE) is 0 and unmap_end becomes -1.  Casting unmap_end to u64
turns it into U64_MAX, so (u64)unmap_end > (u64)unmap_start is true and
unmap_mapping_range() is called with a holelen of 0 (or -PAGE_SIZE), which
unmaps all page table entries from unmap_start to EOF.

[1] https://sashiko.dev/#/bug/linux-d9244c37-209f-42ee-9567-f317e50a1be0

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111084155.80971-1-zhujun2@cmss.chinamobile.com?part=1