Re: [PATCH bpf-next v4 2/8] bpf: Associate arena pages with their mapping

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Fri Oct 16, 2026 at 2:02 AM UTC, Alexei Starovoitov wrote:
> On Wed, Oct 14, 2026 at 11:34 PM Emil Tsalapatis <emil@etsalapatis.com> wrote:
>> Associate arena backing pages with the arena's private mapping and set
>> their page offsets. This allows the fault handler to delegate user PTE
>> installation to generic MM code, which is itself useful for avoiding
>> races with kfunc-related arena operations.
>
> arena_vm_fault() returns vmf->page and finish_fault() installs the pte
> today. That doesn't need page->mapping. VM_FAULT_LOCKED doesn't either.
> tcmu_vma_fault() returns it for alloc_page()-ed pages.
> mm folks were removing page->mapping and index from drivers. See
> commit 6cdef2ddce2b ("fb_defio: do not use deprecated page->mapping, index fields").
>
> [...]
>> +/* Arena pages are not page-cache entries and must not be evicted by MM. */
>> +static bool arena_release_folio(struct folio *folio, gfp_t gfp)
>> +{
>> +	return false;
>> +}
>
> The only place that looks at folio->mapping because of VM_FAULT_LOCKED
> is PageHWPoison() branch in __do_fault().
> If that's the reason for this patch then check PageHWPoison() in
> arena_vm_fault() and return VM_FAULT_HWPOISON.
> Drop this patch.


Agreed on dropping it, but the check in arena_vm_fault() does not close
the hole. memory_failure() sets PG_hwpoison before it takes the folio
lock, so the page can become poisoned after arena_vm_fault() checks it
and before __do_fault() does. __do_fault() then sees VM_FAULT_LOCKED on
a poisoned page. If another process that maps the arena already has the
page mapped, it calls unmap_mapping_folio(), which takes i_mmap_rwsem
of a NULL mapping.

The next version doesn't return VM_FAULT_LOCKED. arena_vm_fault()
locks the page, rechecks vmalloc_to_page() under arena->spinlock, and
installs the pte itself with finish_fault() before it unlocks the page.
It checks for poison before finish_fault() and again after it, zapping
the new pte if the page got poisoned in between. It returns
VM_FAULT_NOPAGE, so __do_fault() never reaches its poison branch, and no
page->mapping is needed. As you suggested, the free waits for the page
lock before zap_pages().