From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3198F280330; Mon, 16 Mar 2026 14:29:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773671356; cv=none; b=h+L1X9DpyE3S73JdT6m29d8IUBTLn6QDc28H3oejTAKKf41M9+K8agOkK8Edx2bBYfBJfQiDQK5B/uC9xOt97EB3Jpd1lFDkYkZ0HHkQaS5iF3ppRAa1KXnUkCBDfVylww13VTsW+locBYu/FGuYvnOMj0o07W9hFhinlzTVc7o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773671356; c=relaxed/simple; bh=PFUSnO/9ILgelOXbwjEIMdn/Aab1PlCJ0qMrqAnbvw4=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=kRmLJJgqG+p0ZOnxyBW+ErBRLvRF4uzu5DHvEXpQ2mhIBcMNWsnyHshHybW4oNiohniuy8USKRjbUPIn+fCktcvYlWYomxXBMuJJrUP4Pq9h8T/IdFxoxNOIkH81IlvhOKlNDt8jViT5Zsf35tc37Mzj9dymmlsWngoG1isz/vE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ZNArTqce; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZNArTqce" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 901EFC19421; Mon, 16 Mar 2026 14:29:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1773671355; bh=PFUSnO/9ILgelOXbwjEIMdn/Aab1PlCJ0qMrqAnbvw4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=ZNArTqce345KwAkB2/OySCnh6EME1XoJwR/oAl0lWq7Ylt9gkTfk6stvl4mVK9/3F KwYOcm79Ed4P16v4AgfrWxgeQ5kXFytmq8JtvKgeAJBHJni4gvkqoXRwSRojWkzMXW KjdJCy/qJzif6rc5Ha23V7TyHyiPTJueX/dmlebfwa3TllC3B8dzFJIvh09GNdM5hA U109OB4NNCj4y6zxKWnPMdODpWkf+W9tJkoIot699UjVOMo5rbg+oOW+XblrH75bPT 2K9hfeg+fCNBKA/MiRSMUpOgDleW7qa6JeZtPbHw5YSqiNeQgyfmSpebEkCOjXVHFZ N7HDaEOyJ+00A== Date: Mon, 16 Mar 2026 14:29:04 +0000 From: "Lorenzo Stoakes (Oracle)" To: Suren Baghdasaryan Cc: Usama Arif , Andrew Morton , Clemens Ladisch , Arnd Bergmann , Greg Kroah-Hartman , "K . Y . Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Alexander Shishkin , Maxime Coquelin , Alexandre Torgue , Miquel Raynal , Richard Weinberger , Vignesh Raghavendra , Bodo Stroesser , "Martin K . Petersen" , David Howells , Marc Dionne , Alexander Viro , Christian Brauner , Jan Kara , David Hildenbrand , "Liam R . Howlett" , Vlastimil Babka , Mike Rapoport , Michal Hocko , Jann Horn , Pedro Falcato , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-mtd@lists.infradead.org, linux-staging@lists.linux.dev, linux-scsi@vger.kernel.org, target-devel@vger.kernel.org, linux-afs@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, Ryan Roberts Subject: Re: [PATCH 05/15] fs: afs: correctly drop reference count on mapping failure Message-ID: <2536c05e-e228-404f-9916-906c0447b114@lucifer.local> References: <4a5fa45119220b9d99ed72a36308aed01a30d2c1.1773346620.git.ljs@kernel.org> <20260313110745.2573005-1-usama.arif@linux.dev> Precedence: bulk X-Mailing-List: linux-doc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: On Sun, Mar 15, 2026 at 07:32:54PM -0700, Suren Baghdasaryan wrote: > On Fri, Mar 13, 2026 at 5:00 AM Lorenzo Stoakes (Oracle) wrote: > > > > On Fri, Mar 13, 2026 at 04:07:43AM -0700, Usama Arif wrote: > > > On Thu, 12 Mar 2026 20:27:20 +0000 "Lorenzo Stoakes (Oracle)" wrote: > > > > > > > Commit 9d5403b1036c ("fs: convert most other generic_file_*mmap() users to > > > > .mmap_prepare()") updated AFS to use the mmap_prepare callback in favour of > > > > the deprecated mmap callback. > > > > > > > > However, it did not account for the fact that mmap_prepare can fail to map > > > > due to an out of memory error, and thus should not be incrementing a > > > > reference count on mmap_prepare. > > This is a bit confusing. I see the current implementation does > afs_add_open_mmap() and then if generic_file_mmap_prepare() fails it > does afs_drop_open_mmap(), therefore refcounting seems to be balanced. > Is there really a problem? Firstly, mmap_prepare is invoked before we try to merge, so the VMA could in theory get merged and then the refcounting will be wrong. Secondly, mmap_prepare occurs at such at time where it is _possible_ that allocation failures as described below could happen. I'll update the commit message to reflect the merge aspect actually. > > > > > > > > > With the newly added vm_ops->mapped callback available, we can simply defer > > > > this operation to that callback which is only invoked once the mapping is > > > > successfully in place (but not yet visible to userspace as the mmap and VMA > > > > write locks are held). > > > > > > > > Therefore add afs_mapped() to implement this callback for AFS. > > > > > > > > In practice the mapping allocations are 'too small to fail' so this is > > > > something that realistically should never happen in practice (or would do > > > > so in a case where the process is about to die anyway), but we should still > > > > handle this. > > nit: I would drop the above paragraph. If it's impossible why are you > handling it? If it's unlikely, then handling it is even more > important. Sure I can drop it, but it's an ongoing thing with these small allocations. I wish we could just move to a scenario where we can simpy assume allocations will always succeed :) Vlasta - thoughts? Cheers, Lorenzo > > > > > > > > > Signed-off-by: Lorenzo Stoakes (Oracle) > > > > --- > > > > fs/afs/file.c | 20 ++++++++++++++++---- > > > > 1 file changed, 16 insertions(+), 4 deletions(-) > > > > > > > > diff --git a/fs/afs/file.c b/fs/afs/file.c > > > > index f609366fd2ac..69ef86f5e274 100644 > > > > --- a/fs/afs/file.c > > > > +++ b/fs/afs/file.c > > > > @@ -28,6 +28,8 @@ static ssize_t afs_file_splice_read(struct file *in, loff_t *ppos, > > > > static void afs_vm_open(struct vm_area_struct *area); > > > > static void afs_vm_close(struct vm_area_struct *area); > > > > static vm_fault_t afs_vm_map_pages(struct vm_fault *vmf, pgoff_t start_pgoff, pgoff_t end_pgoff); > > > > +static int afs_mapped(unsigned long start, unsigned long end, pgoff_t pgoff, > > > > + const struct file *file, void **vm_private_data); > > > > > > > > const struct file_operations afs_file_operations = { > > > > .open = afs_open, > > > > @@ -61,6 +63,7 @@ const struct address_space_operations afs_file_aops = { > > > > }; > > > > > > > > static const struct vm_operations_struct afs_vm_ops = { > > > > + .mapped = afs_mapped, > > > > .open = afs_vm_open, > > > > .close = afs_vm_close, > > > > .fault = filemap_fault, > > > > @@ -500,13 +503,22 @@ static int afs_file_mmap_prepare(struct vm_area_desc *desc) > > > > afs_add_open_mmap(vnode); > > > > > > Is the above afs_add_open_mmap an additional one, which could cause a reference > > > leak? Does the above one need to be removed and only the one in afs_mapped() > > > needs to be kept? > > > > Ah yeah good spot, will fix thanks! > > > > > > > > > > > > > ret = generic_file_mmap_prepare(desc); > > > > - if (ret == 0) > > > > - desc->vm_ops = &afs_vm_ops; > > > > - else > > > > - afs_drop_open_mmap(vnode); > > > > + if (ret) > > > > + return ret; > > > > + > > > > + desc->vm_ops = &afs_vm_ops; > > > > return ret; > > > > } > > > > > > > > +static int afs_mapped(unsigned long start, unsigned long end, pgoff_t pgoff, > > > > + const struct file *file, void **vm_private_data) > > > > +{ > > > > + struct afs_vnode *vnode = AFS_FS_I(file_inode(file)); > > > > + > > > > + afs_add_open_mmap(vnode); > > > > + return 0; > > > > +} > > > > + > > > > static void afs_vm_open(struct vm_area_struct *vma) > > > > { > > > > afs_add_open_mmap(AFS_FS_I(file_inode(vma->vm_file))); > > > > -- > > > > 2.53.0 > > > > > > > > > > > > Cheers, Lorenzo