Re: [PATCH 1/5] mm: limit pagecache folio refcount when mapping pages

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] mm: missing folio_ref_count_over_limit() check in
  copy_huge_pud()
--

commit f7e3ed38c742cda863dfe55787d1e17c689cd9cb
Author: David Hildenbrand (Arm) <david@kernel.org>

mm: limit pagecache folio refcount when mapping pages

This commit introduces FOLIO_REF_COUNT_LIMIT, FOLIO_REF_COUNT_ADMIN_LIMIT, and
folio_ref_count_over_limit() to prevent large pagecache folio reference counts
and mapcounts from overflowing when adding or duplicating file mappings.

> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index d0e19d9e6b651..2596ff0f0e185 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
[ ... ]
> @@ -1784,6 +1790,10 @@ static vm_fault_t insert_pud(struct vm_area_struct *vma, unsigned long addr,
>  	if (fop.is_folio) {
>  		entry = folio_mk_pud(fop.folio, vma->vm_page_prot);
>  
> +		if (unlikely(folio_ref_count_over_limit(fop.folio))) {
> +			ret = VM_FAULT_SIGBUS;
> +			goto out_unlock;
> +		}
>  		folio_get(fop.folio);
>  		folio_add_file_rmap_pud(fop.folio, &fop.folio->page, vma);
>  		add_mm_counter(mm, mm_counter_file(fop.folio), HPAGE_PUD_NR);

[Severity: Medium]
The commit message notes that each folio_add_file_rmap*() and
folio_dup_file_rmap*() call needs a prior folio_ref_count_over_limit() check,
and insert_pud() is updated here accordingly.

However, when forking a VMA that passes vma_needs_copy() and contains a
PUD-mapped folio, copy_page_range() -> copy_p4d_range() -> copy_pud_range() ->
copy_huge_pud() in mm/huge_memory.c also increments the folio reference count
and calls folio_add_file_rmap_pud():

mm/huge_memory.c:copy_huge_pud() {
	...
	page = vm_normal_page_pud(src_vma, addr, pud);
	if (page) {
		struct folio *folio = page_folio(page);

		folio_get(folio);
		/*
		 * TODO: once we support anonymous pages, use
		 * folio_try_dup_anon_rmap_*() and split if duplicating fails.
		 */
		folio_add_file_rmap_pud(folio, page, dst_vma);
		add_mm_counter(dst_mm, mm_counter_file(folio), HPAGE_PUD_NR);
	}
	...
}

Should copy_huge_pud() also check folio_ref_count_over_limit(folio) and return
-ENOMEM (which copy_pud_range() already handles) before calling folio_get()
and folio_add_file_rmap_pud()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105-refcount_overflow_stable-v1-0-70b9c655da3e@kernel.org?part=1