On Tue, Apr 30, 2024 at 3:21 AM Matthew Wilcox <willy@xxxxxxxxxxxxx> wrote:
>
> On Tue, Apr 30, 2024 at 03:11:34AM +0800, Kairui Song wrote:
> > +++ b/fs/nfs/file.c
> > @@ -588,7 +588,7 @@ static vm_fault_t nfs_vm_page_mkwrite(struct vm_fault *vmf)
> >
> > dfprintk(PAGECACHE, "NFS: vm_page_mkwrite(%pD2(%lu), offset %lld)\n",
> > filp, filp->f_mapping->host->i_ino,
> > - (long long)folio_file_pos(folio));
> > + (long long)folio_pos(folio));
>
> Yes, we can't call page_mkwrite() on a swapcache page.
>
> > +++ b/fs/nfs/nfstrace.h
> > @@ -960,7 +960,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event,
> > __entry->fileid = nfsi->fileid;
> > __entry->fhandle = nfs_fhandle_hash(&nfsi->fh);
> > __entry->version = inode_peek_iversion_raw(inode);
> > - __entry->offset = folio_file_pos(folio);
> > + __entry->offset = folio_pos(folio);
> > __entry->count = nfs_folio_length(folio);
> > ),
> >
> > @@ -1008,7 +1008,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done,
> > __entry->fileid = nfsi->fileid;
> > __entry->fhandle = nfs_fhandle_hash(&nfsi->fh);
> > __entry->version = inode_peek_iversion_raw(inode);
> > - __entry->offset = folio_file_pos(folio);
> > + __entry->offset = folio_pos(folio);
>
> These two I don't know about.
I can add a more detailed call chain for this in the commit message to
make it look more convincing.
> > +++ b/fs/nfs/write.c
> > @@ -281,7 +281,7 @@ static void nfs_grow_file(struct folio *folio, unsigned int offset,
> > end_index = ((i_size - 1) >> folio_shift(folio)) << folio_order(folio);
> > if (i_size > 0 && folio_index(folio) < end_index)
> > goto out;
> > - end = folio_file_pos(folio) + (loff_t)offset + (loff_t)count;
> > + end = folio_pos(folio) + (loff_t)offset + (loff_t)count;
>
> This one concerns me. Are we sure we can't call nfs_grow_file()
> for a swapfile?
Right, I did a audit of the code, all callers of nfs_grow_file are listed below:
.write_end -> nfs_write_end -> nfs_update_folio -> nfs_writepage_setup
-> nfs_grow_file
.page_mkwrite -> nfs_vm_page_mkwrite -> nfs_update_folio ->
nfs_writepage_setup -> nfs_grow_file
>
> > @@ -2073,7 +2073,7 @@ int nfs_wb_folio_cancel(struct inode *inode, struct folio *folio)
> > */
> > int nfs_wb_folio(struct inode *inode, struct folio *folio)
> > {
> > - loff_t range_start = folio_file_pos(folio);
> > + loff_t range_start = folio_pos(folio);
> > loff_t range_end = range_start + (loff_t)folio_size(folio) - 1;
>
> Likewise here. Are we absolutely certain that swap I/O can't call this
> function?
Similar above:
.release_folio -> nfs_release_folio -> nfs_wb_folio
.launder_folio -> nfs_launder_folio -> nfs_wb_folio
.write_begin -> nfs_write_begin -> nfs_read_folio -> nfs_wb_folio
.read_folio -> nfs_read_folio -> nfs_wb_folio
nfs_update_folio (listed above) -> nfs_writepage_setup ->
nfs_setup_write_request -> nfs_try_to_update_request -> nfs_wb_folio--
.write_begin -> nfs_write_begin -> nfs_flush_incompatible -> nfs_wb_folio
.page_mkwrite -> nfs_vm_page_mkwrite -> nfs_flush_incompatible -> nfs_wb_folio
And nothing from the swap mapping side can call into fs, except
swap_rw, none of the helpers are called by that.
