Hi, I finally got around to reviving this series. However, I simplified it from v2 and focussed on solving the btrfs search_ioctl() problem only: https://lore.kernel.org/r/20211201193750.2097885-1-catalin.marinas@xxxxxxx The btrfs search_ioctl() function can potentially live-lock on arm64 with MTE enabled due to a fault_in_writeable() + copy_to_user_nofault() unbounded loop. The uaccess can fault in the middle of a page (MTE tag check fault) even if a prior fault_in_writeable() successfully wrote to the beginning of that page. The btrfs loop always restarts the fault-in loop from the beginning of the user buffer, hence the live-lock. The series introduces fault_in_subpage_writeable() together with the arm64 probing counterpart and the btrfs fix. I don't think with the current kernel anything other than btrfs search_ioctl() can live-lock. The buffered file I/O can already cope with current fault_in_*() + copy_*_user() loops (the uaccess makes progress). Direct I/O either goes via GUP + kernel mapping access (and memcpy() can't fault) or, if the user buffer is not PAGE aligned, it may fall back to buffered I/O. So we really only care about fault_in_writeable(), hence this simplified series. If at some point we'll need to address other places, we can expand the sub-page probing to the other fault_in_*() functions. Thanks. Catalin Marinas (3): mm: Add fault_in_subpage_writeable() to probe at sub-page granularity arm64: Add support for user sub-page fault probing btrfs: Avoid live-lock in search_ioctl() on hardware with sub-page faults arch/Kconfig | 7 +++++++ arch/arm64/Kconfig | 1 + arch/arm64/include/asm/mte.h | 1 + arch/arm64/include/asm/uaccess.h | 15 +++++++++++++++ arch/arm64/kernel/mte.c | 30 ++++++++++++++++++++++++++++++ fs/btrfs/ioctl.c | 7 ++++++- include/linux/pagemap.h | 1 + include/linux/uaccess.h | 22 ++++++++++++++++++++++ mm/gup.c | 29 +++++++++++++++++++++++++++++ 9 files changed, 112 insertions(+), 1 deletion(-)
