From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 68BD0606A326 for ; Sat, 7 Nov 2026 22:24:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=GWg5Gcle Received: by kanga.kvack.org (Postfix) id 1913C6B05BC; Sat, 7 Nov 2026 17:24:18 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 1415F6B05BD; Sat, 7 Nov 2026 17:24:18 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 02FA96B05BE; Sat, 7 Nov 2026 17:24:17 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id C93696B05BC for ; Sat, 7 Nov 2026 17:24:17 -0500 (EST) Received: from smtpin13.hostedemail.com (lb01a-stub [10.200.18.249]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 528261C3BE4 for ; Sat, 7 Nov 2026 22:24:17 +0000 (UTC) X-FDA: 85409752554.13.8E77FA2 Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by imf11.hostedemail.com (Postfix) with ESMTP id 82EAA40006 for ; Sat, 7 Nov 2026 22:24:15 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20260515 header.b=GWg5Gcle; spf=pass (imf11.hostedemail.com: domain of david@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=david@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1794090255; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=eg5b15u+rTVmwb11gnjCWgwIU3XL9azsyPKK5bBy5wk=; b=Akik+45oL//N4GsTMUNK9zIjewPMb4tYbXBtrqbgzUWstVR9Y6lD9IskYx2pqcNumbcrLQ sYO+YZOmDt0jDefBtZuJToo9zVKs2b/fpb3ZFxG/wSPe7hwyXXl1giMPlqjGdDpxRqUmNz F9AzwotMPn/6fF8sJqz+gFz/CsDlJcU= ARC-Seal: i=1; a=rsa-sha256; d=hostedemail.com; s=arc-20220608; cv=none; t=1794090255; b=y+DeJ53iudPokT5Y1O+M+JDv1bAp6m/KemY8P5lirOXnff0spavEG1cC9MsC8D0Vskrcys 80+uVMvH8z8B0e5iJBYbLku/yDWWeu5gQvWtZv3CpPYdbEVS83ipt7OgduIf5nYlCzVT34 uxlhcdWKR2lZ0V5O0NZD8WJhBhIYb3w= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20260515 header.b=GWg5Gcle; spf=pass (imf11.hostedemail.com: domain of david@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=david@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id ADA0F42DE4; Sat, 7 Nov 2026 22:24:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B7C641F0089F; Sat, 7 Nov 2026 22:24:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794090254; bh=eg5b15u+rTVmwb11gnjCWgwIU3XL9azsyPKK5bBy5wk=; h=From:Subject:Date:To:Cc; b=GWg5GclejkN5ISovErIV30qR90Bi6M6LkEDCS66iT3mU4aWIxfBW6GdXWslhQ7KgU bK2z7C57+zrCBW1sTMdPz5zM7FsbRSYjesUJapWWIfNDcDrmzfUmIvmtu49TM1mwxv ja1zpWR8RkkSLTFEnixGVPpPY0u8Xgu8/gYQTOLGb0/w3HPLSLRNl56SVK2CUNW5pY JlunxVAYzoMCU+KA+V4Dtqk7hhaPNpIozWOFRDahW+dJZjvK1w1mq3LuA5OlkeEcCB G1EoKFs0B4WAyNe/gXvpNnVuxDikDZCpzZS8c+I6ZujIA9lxQT8fFBeby/7BqHJ+jn hfh70rDjAL5WA== From: "David Hildenbrand (Arm)" Subject: [PATCH v2 0/5] mm: limit pagecache folio refcount Date: Sat, 07 Nov 2026 23:23:36 +0100 Message-Id: <20261107-refcount_overflow_stable-v2-0-c38f6809b106@kernel.org> X-Archived-By: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAAAAAAAC/42NQQ6CMBBFr0JmbU1bKEZX3sMQAmWAKmnNtFQN4 e4WvIDLl7z//gIeyaCHS7YAYTTeOJtAHjLQY2MHZKZLDJLLUgiuGGGv3WxD7SJSP7lX7UPTTsh UIZHLQuS8R0jzZzLNe0/fqh/7ub2jDltvM0bjg6PP/h3F5v1xEwXj7MTbsy6V6pocrw8ki9PR0 QDVuq5fdtdUVdMAAAA= X-Change-ID: 20261105-refcount_overflow_stable-542e024130fe To: Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , "Matthew Wilcox (Oracle)" , Jan Kara , Andrew Morton , Zi Yan , Baolin Wang , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Kiryl Shutsemau , Matthew Brost , Joshua Hahn , Byungchul Park , Gregory Price , Ying Huang , Alistair Popple , Peter Xu , Johannes Weiner , Song Liu , Rik van Riel , Miklos Szeredi , Alexander Viro , Christian Brauner , Hugh Dickins , Will Deacon , "Aneesh Kumar K.V" , Nick Piggin , Peter Zijlstra , Arnd Bergmann , Jason Gunthorpe , Kevin Tian , "Joerg Roedel (AMD)" , Robin Murphy , Steve Sistare , John Hubbard , "Jose A. Perez de Azpillaga" , Josef Bacik Cc: "David Hildenbrand (Arm)" , linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, fuse-devel@lists.linux.dev, linux-arch@vger.kernel.org, iommu@lists.linux.dev, Chris Mason , stable@vger.kernel.org, Jason Gunthorpe X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6873; i=david@kernel.org; h=from:subject:message-id; bh=9KzEE59aveBB6sn+9WVX/Ykd3tcmn6ZAgwUHPEnyXys=; b=owGbwMvMwCF2/OVpCdfQ3ZWMp9WSGLLeL/k3/57Hr8ubliccFjHQiduuuuG/ekXyhtzI5NMb9 Zdem5tq31HKwiDGwSArpsgSFHzf4OXLdbXVbnzMMHNYmUCGMHBxCsBE9hcw/C/1mMcyeUuf7K+r rEYBB6allwjdUjOSUxbg4TJ88WqS3HtGhvl/6sWuuraz8F5ZxhSsye66MPqM5p6Gvzs/mLi+dWt gZwMA X-Developer-Key: i=david@kernel.org; a=openpgp; fpr=1BD9CAAD735C4C3A460DFCCA4DDE10F700FF835A X-Rspamd-Server: rspam06 X-Stat-Signature: 9jepkf9qkxm93sg4incwwpacjd5ho5ay X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_PASS, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=4.0.1 X-Rspamd-Queue-Id: 82EAA40006 X-Rspam-User: X-HE-Tag: 1794090255-983275 X-HE-Meta: U2FsdGVkX199VOwoN/G6zoJODtRCFcXm5PhvKRBKy3YJXMexfnMyI7HK0y9Fuc9PQFM+FGhmUFvBZC3sa+QDiXBfaaEZp2L4fEXs7iHLHsvM+sdW9veXA4Zm9A8oCamxAPE3fS6tAPZn5sbxkJqSSbQxyLpBF+yGWa6kHW1Vvq1CfDvvplLUiqHsNAWiBd2H7ppZ/td9G/dGwtFIUxzw/huUE3kY0nfYj7R3QpODPI0vALXnEbpR7yAjWygkBhE7gp2qKxEi0vjM/RQEh6S6aRkkgqy/sS9mdZBLrPpTkqojWZFYXjHHX09TwlPBB4alapBMBcLjs/de26pT6sJ7YVYwyf2Udo4TL1h5v2i613QMEMOdU6McyTgiBtvtY/sv5HGk0uIz9ouWrXwuVlhGHnsysbBIKrXf2JWd7KGfGf59sKQtSs4Y6kBDcx10AQx+MW2ijkcc0eA1uowB+rO0OjPACV2eVWsni7tJEH2sSiZ5vaqDH25kUsVAhfdq22tqX9V0D9dBrZvjHhCdrqbR/grZhPxjOmkmPZX84r+85pc+Svj9XMClO9UuxB7Mdaw5nLy8LGKv7bGJnVJ4eAMqZwa21LFdiQBU4P9e1uuXyC1hgfHfYdLuyjJebimOpzbWFPsylqshdGwXohfBA+/RsQ97CpxxZSNj01UGVsBrwnzRZ7WewjYTpYIh2ZhSSnbKo3UUfUrLRFo7md026WCwsTshkU1xbqkeVifoxz6D123l93vy2sJPMgj9AinD7aqVj3NWPqUPIf7hIwH7Jz/ycjxwmi1eL148DEa+yXVp0OnZ971uNTcxBA9hxTswC0GFWgoPHQEbNRjXdm/R5ygt/+UFMnxjQC/eEIEEAUkb/MyL1xq9x6+lN7+t+zkq6q12pWinQ9L3OHFRP0ZjJHbH2jPJkSiUrPQVzgqIku5jRz6fdv3xPca2o4wE5H60ZN/BQF+mfWSiMcy81MN7uWl 8SyUy94X O+32no8Cus/bNl6SE4kitreELwjthug8z6aIgEPOH2cc9BUVI4htftHAAHcsTIVgLaOOtC0eFKq5ZI/igtZYmHhKFtKPOucHdCE+Gp3EniTIboT+r7dz1PqJAvBI74Apq4aQu2T7o3x76hIXCIYjnPHKppeGgofeEBhjD3vjK2Ez+dsjZl7IRc9/F5T8/1d55RKqs2xANFjf2w2Ano+Q/5YN5DQpOfx6Xq3Xw5T8xaCphPl2tOMH/9LcuqZh1FjYgizZqJiZdYalcJgj+xWuTCdIcBkB+hrN3PMnoPUTkybBxxXV68x1OJyZucop4mDbz4FqdnzoOguy+AP6uwuGvsmC/wfx6BEdR4kcpl7zwsn36CEFecsNUYUPmItsuZqwV2t0pqGeyupmefn7ngvFjX2XMDyi2Ir3yiQL/CwbutiVl3Ut0J6K9rLLMTHq2LfdIU0s6y3noVUJOAZ7PrWxM/AQ4HFuDkFOxQuk7KI+bsYqAEkxdmXwkITZg1MTIWRbdi9CFYEEDxO6CBqJSJKzn1qT1I93aDWsga9Qx5zVbyCqfUEGLUc9Te2Nvt9mTLJydGykBylGYbIMMDL2GhME6OqXfSN7Yh68O/pLNPXibjDwhfmElf/vH0KpLaUAsn+WZdYa1wmnPO36SySlChkY3ID6+RLB4kEfngmtlZq2OvTNZkZAx2grjWGyh1DYlQj0XJmk8qvpiojHEeOOJYyn0fHaiAlMSuwkYTqgXg2JQP9cKJOow2HpDtEHo4F0X1Wb1SOqxl10YiHpQJuLPOcjO52pRyJqbytYNfHIwPNKy59qjRTvqbOX//WceIsgC4VdiqenTnwRFOmYbbPMmzPH5n66C0otDQaodqzGWKrD1Bi6JDBFMRBbGjRIWaEmGqeXf9Jcbd+9J4dNzyJGAVR0n4aLygpueXR9Mvj7WDEoXsNHAjDp2rZgEwehK3VxlOWdzN8hSEIM+78Frpg6BVT4Gze5C8jUE H07JVizO 689yGBy6y4KaDBkBPoZemreZqTxbBAyNfOhGECB4pFiI577TNjTWFXa+DljvIbAxIt8qKi7OmxfbPo5iQOzcxcfjoNudEufrxoqo9hBiiea/hE8R22lOeBnMylsfS+mNRiRP3Wbe2ZC0XhZYx5eownNmGsVKBFHrUyig73vr9Y+kosEbrnCUYCF4tClqT0caSA9iuFF3ojAl82yMk7WhFsqAYFmg+ZpiJmfNOr20fFgd63WIP0SvgQbbNnfu4Jgn9RajpC3K9o88CWhq90Pa/t+kpeFU561d335o1pZFg0HJ5ZubkWbKd2MSBnrSt7xz Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 Users can create a lot of folio references to pagecache folios, making it possible to overflow the refcount of large folios. While we knew that one could in theory overflow a folio's refcount, we mostly assumed that bad things would happen and it wouldn't go unnoticed. Not so sure if that is really always the case, and leaving that problem unsolved is irresponsible, so let's limit pagecache folio refcounts. This is really only relevant for large folios / thps in the page cache. With anon folios (including THPs), we should not be able to trigger folio refcount overflows (until we get PUD-sized ones ;) ). It was likely a problem for anon folios as well before we had a dedicated pincount. Let's limit the refcount before it turns negative, giving admin processes some extra reserves (to recover a problematic system). We still leave some headroom to allow for some slight limit overshooting, to make the implementation easier. Then, we also check when splicing pagecache folios to a pipe, and improve our existing checks in gup. We also have to take care of mmu_gather, to not hold too many references when zapping (whereby new page faults could remap pages concurrently). This is only a temporary solution for upstream+stable, until we have something better. These fixes will be a bit challenging to backport to stable, but it will be much easier compared to the RFC series I have here were we do things properly by (what we discussed a couple of times earlier): - Letting the mapcount of large folios be a long - Holding a single refcount if the folio is mapped, across all mappings - Reverting the limits introduced in this series I'll polish that up and send it once we merged something that can be backported to stable. Tested on x86-64 by lowering the folio refcount limits such that limits can easily be exceeded, to then test fault (SIGBUS), fork(), splice and GUP behavior briefly when we run into refcount limits on a shmem THP. Signed-off-by: David Hildenbrand (Arm) --- Changes in v2: - "mm: limit pagecache folio refcount when mapping pages" - Try not to fail fork() by skipping the PTE/PUD instead. We still have to fail in two scenarios. - Split helper into fast and slow path. Slow path in mm/util.c, exported for Fuse usage in patch #2. - Check has_capability_noaudit(current, CAP_SYS_RESOURCE) instead of capable(CAP_SYS_RESOURCE) - Extended patch description and improved function documentation. - Dropped RBs due to changes. - "mm: limit pagecache folio refcount when splicing into pipes" - Return -EOVERFLOW from filemap_splice_read() and shmem_file_splice_read(), and handle it in do_splice_read() by falling back to a copy. - Check in fuse_copy_folio() as well - Updated patch description and updated+improved comments/doc - Dropped RB due to changes - "mm/mmu_gather: flush pending references early before the folio limit" - Adjust some comments - Update Fixes: - Extend patch description - "mm/gup: limit pagecache folio refcount when grabbing references" - Keep all WARN_ON_ONCE() checks for negative/null refcounts - Skip has_capability_noaudit(current, CAP_SYS_RESOURCE) with disabled interrupts, skipping it for GUP-fast. - Properly forward try_grab_folio() errors - Adjust some comments - Link to v1: https://patch.msgid.link/20261105-refcount_overflow_stable-v1-0-70b9c655da3e@kernel.org To: David Hildenbrand To: Lorenzo Stoakes To: "Liam R. Howlett" To: Vlastimil Babka To: Mike Rapoport To: Suren Baghdasaryan To: Michal Hocko To: "Matthew Wilcox (Oracle)" To: Jan Kara To: Andrew Morton To: Zi Yan To: Baolin Wang To: Nico Pache To: Ryan Roberts To: Dev Jain To: Barry Song To: Lance Yang To: Usama Arif To: Kiryl Shutsemau To: Matthew Brost To: Joshua Hahn To: Byungchul Park To: Gregory Price To: Ying Huang To: Alistair Popple To: Peter Xu To: Johannes Weiner To: Song Liu To: Rik van Riel To: Miklos Szeredi To: Alexander Viro To: Christian Brauner To: Hugh Dickins To: Will Deacon To: "Aneesh Kumar K.V" To: Nick Piggin To: Peter Zijlstra To: Arnd Bergmann To: Jason Gunthorpe To: Kevin Tian To: "Joerg Roedel (AMD)" To: Robin Murphy To: Steve Sistare To: John Hubbard To: Jose A. Perez de Azpillaga To: Josef Bacik Cc: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: fuse-devel@lists.linux.dev Cc: linux-arch@vger.kernel.org Cc: iommu@lists.linux.dev --- David Hildenbrand (Arm) (5): mm: limit pagecache folio refcount when mapping pages mm: limit pagecache folio refcount when splicing into pipes mm/mmu_gather: flush pending references early before the folio limit iommufd: fix cleanup when adding memfd folio pins fails mm/gup: limit pagecache folio refcount when grabbing references drivers/iommu/iommufd/pages.c | 15 +++++++++---- fs/fuse/dev.c | 5 +++-- fs/splice.c | 8 ++++++- include/asm-generic/tlb.h | 4 ++-- include/linux/mm.h | 51 +++++++++++++++++++++++++++++++++++-------- mm/filemap.c | 17 ++++++++++++--- mm/gup.c | 24 ++++++++++++-------- mm/huge_memory.c | 29 ++++++++++++++++++++++-- mm/memory.c | 39 ++++++++++++++++++++++++++++----- mm/migrate.c | 11 ++++++++++ mm/mmu_gather.c | 10 +++++---- mm/shmem.c | 4 ++++ mm/userfaultfd.c | 4 ++++ mm/util.c | 15 +++++++++++++ 14 files changed, 194 insertions(+), 42 deletions(-) --- base-commit: df3c65887715e66e2cba69116924020c37996cd8 change-id: 20261105-refcount_overflow_stable-542e024130fe Best regards, -- David Hildenbrand (Arm)